github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 08:01:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #5836] fix(expo): account linking flow on mobile #14510

New Issue
Closed
opened 2026-04-13 09:30:47 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 09:30:47 -05:00
Owner
Copy Link

Original Pull Request: https://github.com/better-auth/better-auth/pull/5836

State: closed
Merged: Yes

Fixes account linking flow on mobile (avoid overriding all cookies after a link-social call)

Currently, after linking a social account, the flow completes successfully, and everything looks good on the backend. However, in the app, the session is lost, causing it to enter an "unauthenticated" state.

I found that this occurs because the redirection URL after the social account linking flow looks something like this:

my-app:///a-path?cookie=better-auth.state%3D%3B+Max-Age%3D0%3B+Secure

This URL attempts to reset the state cookie but ends up wiping out all cookies instead.

This PR avoids that by using the following pattern already present in the same function:

const prevCookie = await storage.getItem(cookieName);
const toSetCookie = getSetCookie(cookie, prevCookie ?? undefined);
storage.setItem(cookieName, toSetCookie);

Context

  • Expo
  • Hono backend
  • Generic OAuth provider

Summary by cubic

Preserves existing cookies during the mobile link-social redirect so the session stays authenticated after account linking. Merges the new cookie with stored cookies instead of overwriting them.

  • Bug Fixes
    • Read the previous cookie and call getSetCookie(cookie, prevCookie) before storage.setItem.
    • Added a test to confirm new cookies are added and existing cookies remain unchanged.

Written for commit 9e78ef27d5. Summary will update automatically on new commits.

**Original Pull Request:** https://github.com/better-auth/better-auth/pull/5836 **State:** closed **Merged:** Yes --- # Fixes account linking flow on mobile (avoid overriding all cookies after a link-social call) Currently, after linking a social account, the flow completes successfully, and everything looks good on the backend. However, in the app, the session is lost, causing it to enter an "unauthenticated" state. I found that this occurs because the redirection URL after the social account linking flow looks something like this: `my-app:///a-path?cookie=better-auth.state%3D%3B+Max-Age%3D0%3B+Secure` This URL attempts to reset the state cookie but ends up wiping out all cookies instead. This PR avoids that by using the following pattern already present in the same function: ```ts const prevCookie = await storage.getItem(cookieName); const toSetCookie = getSetCookie(cookie, prevCookie ?? undefined); storage.setItem(cookieName, toSetCookie); ``` ## Context - Expo - Hono backend - Generic OAuth provider <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Preserves existing cookies during the mobile link-social redirect so the session stays authenticated after account linking. Merges the new cookie with stored cookies instead of overwriting them. - **Bug Fixes** - Read the previous cookie and call getSetCookie(cookie, prevCookie) before storage.setItem. - Added a test to confirm new cookies are added and existing cookies remain unchanged. <sup>Written for commit 9e78ef27d5781d90756dcdf887d4399a7708d864. Summary will update automatically on new commits.</sup> <!-- End of auto-generated description by cubic. -->
GiteaMirror added the pull-request label 2026-04-13 09:30:47 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#14510
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?