Redirection after sign in #1471

New Issue

2026-03-13T08:42:01-05:00

GiteaMirror commented

2026-03-13 08:42:01 -05:00

Originally created by @wxl306 on GitHub (Jul 7, 2025).

Is this suited for github?

Yes, this is suited for github

To Reproduce

exactly same questions from :
So I have better auth running on my express server. and better auth client on my Nextjs frontend. Express server is running on localhost:4000 and Nextjs on localhost:3000

The issue is after I initiate google login from NextJs (3000 port), the login is successful, however I get redirected to localhost:4000 as in the server URL.

For example:
authClient.signIn.social({
provider: "google",
callbackUrl: "/todo"
})

With this the expected behavior is to get redirected to lcoalhost:3000/todo after login. But I am getting redirected to localhost:4000/todo.

Now I figured that, this is happening because google console has authorized redirect URI set to http://localhost:4000/api/auth/callback/google since localhost:4000 is the one that is making the request.

So I have to pass the full frontend URL (localhost:3000/todo) as callback.

does it mean we have to set up the full callbackurl address when we are using monorepo proejct to seperate the client and server?

Current vs. Expected behavior

current localhost:4000/todo，expected behavior is to get redirected to lcoalhost:3000/todo after login

What version of Better Auth are you using?

1.2.12

Provide environment information

WINDOWS 10
CHORME

Which area(s) are affected? (Select all that apply)

Client

Auth config (if applicable)

Additional context

No response

Originally created by @wxl306 on GitHub (Jul 7, 2025). ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce exactly same questions from [:](https://www.answeroverflow.com/m/1364993857653309531) So I have better auth running on my express server. and better auth client on my Nextjs frontend. Express server is running on localhost:4000 and Nextjs on localhost:3000 The issue is after I initiate google login from NextJs (3000 port), the login is successful, **however I get redirected to localhost:4000 as in the server URL**. For example: authClient.signIn.social({ provider: "google", **callbackUrl: "/todo"** }) With this the expected behavior is to get redirected to lcoalhost:3000/todo after login. But I am getting redirected to localhost:4000/todo. Now I figured that, this is happening because google console has authorized redirect URI set to http://localhost:4000/api/auth/callback/google since localhost:4000 is the one that is making the request. So I have to pass the full frontend URL (localhost:3000/todo) as callback. does it mean we **have to set up the full callbackurl address** when we are using monorepo proejct to **seperate the client and server**? ### Current vs. Expected behavior current localhost:4000/todo，expected behavior is to get redirected to lcoalhost:3000/todo after login ### What version of Better Auth are you using? 1.2.12 ### Provide environment information ```bash WINDOWS 10 CHORME ``` ### Which area(s) are affected? (Select all that apply) Client ### Auth config (if applicable) ```typescript ``` ### Additional context _No response_

GiteaMirror added the express nextjs labels 2026-03-13 08:42:01 -05:00

GiteaMirror closed this issue

2026-03-13 08:42:01 -05:00

GiteaMirror commented

2026-03-13 08:42:02 -05:00

@dosubot[bot] commented on GitHub (Jul 7, 2025):

This happens because when your client and server run on different origins (localhost:3000 for Next.js, localhost:4000 for Express), passing a relative callback URL like /todo will always redirect to the server's origin (localhost:4000/todo). To redirect users back to your frontend after login, you must provide the full absolute callback URL (e.g., http://localhost:3000/todo) in your sign-in call. This is by design—Better Auth resolves relative callback URLs against the server's origin, and there's no built-in way for it to infer your frontend's URL in a multi-origin setup. This pattern is common in OAuth flows and is necessary due to browser security and cross-origin cookie policies discussion.

For best results: always pass the full frontend URL as the callback when your client and server are on different origins. Make sure your Google OAuth redirect URI is set to your backend (e.g., http://localhost:4000/api/auth/callback/google), and your Better Auth config uses the correct baseURL for the API issue. Recent updates in Better Auth have improved callback URL handling, but the requirement to use an absolute URL for cross-origin redirects remains pull request.

If you deploy to production, consider using subdomains (like app.example.com and api.example.com) to simplify cookie and redirect handling discussion.

To reply, just mention @dosu.

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

@dosubot[bot] commented on GitHub (Jul 7, 2025):  This happens because when your client and server run on different origins (localhost:3000 for Next.js, localhost:4000 for Express), passing a relative callback URL like `/todo` will always redirect to the server's origin (localhost:4000/todo). To redirect users back to your frontend after login, you must provide the full absolute callback URL (e.g., `http://localhost:3000/todo`) in your sign-in call. This is by design—Better Auth resolves relative callback URLs against the server's origin, and there's no built-in way for it to infer your frontend's URL in a multi-origin setup. This pattern is common in OAuth flows and is necessary due to browser security and cross-origin cookie policies [discussion](https://github.com/better-auth/better-auth/discussions/3262). For best results: always pass the full frontend URL as the callback when your client and server are on different origins. Make sure your Google OAuth redirect URI is set to your backend (e.g., `http://localhost:4000/api/auth/callback/google`), and your Better Auth config uses the correct `baseURL` for the API [issue](https://github.com/better-auth/better-auth/issues/2710). Recent updates in Better Auth have improved callback URL handling, but the requirement to use an absolute URL for cross-origin redirects remains [pull request](https://github.com/better-auth/better-auth/pull/2740). If you deploy to production, consider using subdomains (like `app.example.com` and `api.example.com`) to simplify cookie and redirect handling [discussion](https://github.com/better-auth/better-auth/discussions/3262).  *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/0b08f69e-e513-49eb-883e-b2f6f0dee92d?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/0b08f69e-e513-49eb-883e-b2f6f0dee92d?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/0b08f69e-e513-49eb-883e-b2f6f0dee92d?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/0b08f69e-e513-49eb-883e-b2f6f0dee92d?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/0b08f69e-e513-49eb-883e-b2f6f0dee92d?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/0b08f69e-e513-49eb-883e-b2f6f0dee92d?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/0b08f69e-e513-49eb-883e-b2f6f0dee92d?feedback_type=other)</sup>  [![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot) [![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/3289)

GiteaMirror commented

2026-03-13 08:42:02 -05:00

@piscopancer commented on GitHub (Jul 7, 2025):

Same question... if i change callbackUrl to http://localhost:3000/studio, I get an error saying it's incorrect as i try to call the singIn function

{"code":"INVALID_CALLBACKURL","message":"Invalid callbackURL"}

i feel like the docs is incomplete when it comes to different domains and ports, I am running Express on :8000 and Vite app on :3000, so there's no way I want to redirect to a non-existent express/dashboard or smth, feels to me the docs was written with only nextjs in mind

@piscopancer commented on GitHub (Jul 7, 2025): Same question... if i change `callbackUrl` to `http://localhost:3000/studio`, I get an error saying it's incorrect as i try to call the `singIn` function ```json {"code":"INVALID_CALLBACKURL","message":"Invalid callbackURL"} ``` i feel like the docs is incomplete when it comes to different domains and ports, I am running Express on :8000 and Vite app on :3000, so there's no way I want to redirect to a non-existent express/dashboard or smth, feels to me the docs was written with only nextjs in mind

GiteaMirror commented

2026-03-13 08:42:03 -05:00

@wxl306 commented on GitHub (Jul 8, 2025):

Same question... if i change callbackUrl to http://localhost:3000/studio, I get an error saying it's incorrect as i try to call the singIn function
{"code":"INVALID_CALLBACKURL","message":"Invalid callbackURL"}
i feel like the docs is incomplete when it comes to different domains and ports, I am running Express on :8000 and Vite app on :3000, so there's no way I want to redirect to a non-existent express/dashboard or smth, feels to me the docs was written with only nextjs in mind

If you assign full url like http://localhost:3000/studio to callback url in authclient signin method,it should be ok, it works for me.
Would you mind share more code ?

@wxl306 commented on GitHub (Jul 8, 2025): > Same question... if i change `callbackUrl` to `http://localhost:3000/studio`, I get an error saying it's incorrect as i try to call the `singIn` function > ```json > {"code":"INVALID_CALLBACKURL","message":"Invalid callbackURL"} > ``` > i feel like the docs is incomplete when it comes to different domains and ports, I am running Express on :8000 and Vite app on :3000, so there's no way I want to redirect to a non-existent express/dashboard or smth, feels to me the docs was written with only nextjs in mind > If you assign full url like http://localhost:3000/studio to callback url in authclient signin method,it should be ok, it works for me. Would you mind share more code ?

GiteaMirror commented

2026-03-13 08:42:04 -05:00

@piscopancer commented on GitHub (Jul 8, 2025):

@wxl306 yeah

"better-auth": "^1.2.12"

export const auth = createAuthClient({
  baseURL: 'http://localhost:8484',
})

const res = await auth.signIn.social({
  provider: 'github',
  callbackURL: 'http://localhost:3000/studio',
})
console.log(res)

@piscopancer commented on GitHub (Jul 8, 2025): @wxl306 yeah ```json "better-auth": "^1.2.12" ``` ```ts export const auth = createAuthClient({ baseURL: 'http://localhost:8484', }) ``` ```ts const res = await auth.signIn.social({ provider: 'github', callbackURL: 'http://localhost:3000/studio', }) console.log(res) ``` ![Image](https://github.com/user-attachments/assets/96d21e7e-ad0f-4cfc-98c0-503ee2db1590)

GiteaMirror commented

2026-03-13 08:42:04 -05:00

@piscopancer commented on GitHub (Jul 8, 2025):

br i should have also specified trusted origins 💀

trustedOrigins: ['http://localhost:3000']

now it does not throw 👌

@piscopancer commented on GitHub (Jul 8, 2025): br i should have also specified trusted origins 💀 ```ts trustedOrigins: ['http://localhost:3000'] ``` now it does not throw 👌

GiteaMirror commented

2026-03-13 08:42:05 -05:00

@ping-maxwell commented on GitHub (Jul 8, 2025):

Hey guys, I'll open a PR to improve the error message regarding this.
I will also close this issue for now, please let me know if there are any other concerns regarding this issue and I'll happily reopen it!

For those who are still facing this issue, you can solve it by adding frontend the domain to the trustedOrigins list and making sure the callbackURL is a full absolute path. Like @piscopancer shows.

@ping-maxwell commented on GitHub (Jul 8, 2025): Hey guys, I'll open a PR to improve the error message regarding this. I will also close this issue for now, please let me know if there are any other concerns regarding this issue and I'll happily reopen it! For those who are still facing this issue, you can solve it by adding frontend the domain to the trustedOrigins list and making sure the callbackURL is a full absolute path. Like @piscopancer shows.

GiteaMirror commented

2026-03-13 08:42:05 -05:00

@ping-maxwell commented on GitHub (Jul 8, 2025):

Hey @piscopancer do you mind sending me your auth config? I'm curious if you're using any custom plugin or what your config looks like.
I can't really find that exact error you're facing with the invalid callback url so maybe your config can give me some hint

@ping-maxwell commented on GitHub (Jul 8, 2025): Hey @piscopancer do you mind sending me your auth config? I'm curious if you're using any custom plugin or what your config looks like. I can't really find that exact error you're facing with the invalid callback url so maybe your config can give me some hint

GiteaMirror commented

2026-03-13 08:42:05 -05:00

@piscopancer commented on GitHub (Jul 9, 2025):

@ping-maxwell here's my config, no plugins

export const auth = betterAuth({
  advanced: {
    cookiePrefix: 'jalyk',
    useSecureCookies: true,
  },
  trustedOrigins: ['http://localhost:3000'],
  session: {
    expiresIn: 60 * 60 * 24 * 365,
  },
  baseURL: 'http://localhost:8484',
  socialProviders: {
    github: {
      clientId: '...',
      clientSecret: '...',
    },
    google: {
      clientId: '...',
      clientSecret: '...',
    },
  },
})

@piscopancer commented on GitHub (Jul 9, 2025): @ping-maxwell here's my config, no plugins ```ts export const auth = betterAuth({ advanced: { cookiePrefix: 'jalyk', useSecureCookies: true, }, trustedOrigins: ['http://localhost:3000'], session: { expiresIn: 60 * 60 * 24 * 365, }, baseURL: 'http://localhost:8484', socialProviders: { github: { clientId: '...', clientSecret: '...', }, google: { clientId: '...', clientSecret: '...', }, }, }) ```

GiteaMirror commented

2026-03-13 08:42:06 -05:00

@dingkai031 commented on GitHub (Dec 27, 2025):

br i should have also specified trusted origins 💀

trustedOrigins: ['http://localhost:3000']
now it does not throw 👌

I have this issue just now using the latest better auth. And I wasted 2 hour playing with my cors configuration :(. But I just need to add my FE to trusted origin.

Hopely for development, please add error message like "localhost:30001 is not part of the trusted origins".

@dingkai031 commented on GitHub (Dec 27, 2025): > br i should have also specified trusted origins 💀 > > trustedOrigins: ['http://localhost:3000'] > now it does not throw 👌 I have this issue just now using the latest better auth. And I wasted 2 hour playing with my cors configuration :(. But I just need to add my FE to trusted origin. Hopely for development, please add error message like "localhost:30001 is not part of the trusted origins".

GiteaMirror commented

2026-03-13 08:42:06 -05:00

@nachomglz commented on GitHub (Jan 19, 2026):

This happens because when your client and server run on different origins (localhost:3000 for Next.js, localhost:4000 for Express), passing a relative callback URL like /todo will always redirect to the server's origin (localhost:4000/todo). To redirect users back to your frontend after login, you must provide the full absolute callback URL (e.g., http://localhost:3000/todo) in your sign-in call. This is by design—Better Auth resolves relative callback URLs against the server's origin, and there's no built-in way for it to infer your frontend's URL in a multi-origin setup. This pattern is common in OAuth flows and is necessary due to browser security and cross-origin cookie policies discussion.

This would make sense if the behavior was the same through the entire API, but when you use the exact same method but for email + password login, specifying a relative path it does redirect to the https://frontend/page instead of https://backend/page.

Why is this? I couldn't find anything in the docs regarding this difference.

@nachomglz commented on GitHub (Jan 19, 2026): > This happens because when your client and server run on different origins (localhost:3000 for Next.js, localhost:4000 for Express), passing a relative callback URL like `/todo` will always redirect to the server's origin (localhost:4000/todo). To redirect users back to your frontend after login, you must provide the full absolute callback URL (e.g., `http://localhost:3000/todo`) in your sign-in call. This is by design—Better Auth resolves relative callback URLs against the server's origin, and there's no built-in way for it to infer your frontend's URL in a multi-origin setup. This pattern is common in OAuth flows and is necessary due to browser security and cross-origin cookie policies [discussion](https://github.com/better-auth/better-auth/discussions/3262). This would make sense if the behavior was the same through the entire API, but when you use the exact same method but for email + password login, specifying a relative path it does redirect to the https://frontend/page instead of https://backend/page. Why is this? I couldn't find anything in the docs regarding this difference.

GiteaMirror referenced this issue

2026-03-13 11:15:15 -05:00

[PR #1471] [MERGED] fix(admin): impersonate user session expiration #3821

GiteaMirror referenced this issue

2026-04-13 08:09:31 -05:00

[PR #1471] [MERGED] fix(admin): impersonate user session expiration #12068

GiteaMirror referenced this issue

2026-04-15 19:53:17 -05:00

[PR #1471] [MERGED] fix(admin): impersonate user session expiration #20722

GiteaMirror referenced this issue

2026-04-17 20:45:30 -05:00

[PR #1471] [MERGED] fix(admin): impersonate user session expiration #29422

Sign in to join this conversation.

Branches Tags

agent/deps-sharp-035

agent/deps-opentelemetry-v2

claude/ultraplan-alignment-review-9hzvza

agent/deps-security-floors

2026-07-31/fix/preserve-apple-oauth-user

2026-07-30/chore/upgrade-better-call

2026-07-30/fix/nextjs-rsc-session-refresh

feat/1-7-migration-validation

2026-07-29/refactor/centralize-placeholder-email-generation

changeset-release/main

main

refactor/oauth-client-application-type

2026-07-28/fix/anonymous-oauth-proxy-linking

changeset-release/next

dependabot/npm_and_yarn/demo/electron/demo-minor-patch-2a3bb054a0

dependabot/github_actions/github-actions-42c4bc6a62

dependabot/npm_and_yarn/demo/electron/demo-minor-patch-b1ca80f51d

fix/oauth-provider-session-deletion

feat/scim-demo-workflow

feat/scim-active-user-link

feat/sso-provider-user-resolution

feat/identity-provider-accounts

2026-07-18/fix/expo-secure-store-async

feat/oauth-provider-remove-silence-warnings

changeset-release/release/vercel-announcement

release/vercel-announcement

2026-06-29/docs/optimize-og-images

feat/yandex-social-provider

feat/ssrf-fetch-boundary

codex/pr-10225-next-comments

fix/phone-number-disable-input

perf/router-build-once

fix/oauth-user-provisioning-fields

codex/ignore-compose-override-spellcheck

2026-06-19/fix/stripe-org-reference-scope

feat/webhooks

feat/baseurl-canonical-serving-split

feat/magic-link-expires-in

fix/esbuild-security-bump

chore/sync-main-to-next-20260615

chore/revert-10053

codex/fix-expo-sdk56-dynamic-import

refactor/oauth-provider-client-authentication-module

fix/oauth-no-store-headers

claude/slack-update-stripe-docs-consistency-8Sc0w

local/fix-invite-accept-idempotency

docs/beta-mdx-component-fallback

fix/dependabot-hono-shell-quote

codex/stateless-account-cookie-resolution

fix/admin-create-user-role-escalation

feat/oauth-provider-oidc-acr

refactor/sign-in-challenges

refactor/optional-kysely-dependency

2026-06-06/chore/kysely-changeset

copilot/fix-code-review-comment

starsling/prisma-migration-reset

2026-06-02/fix/next-cookies-defer-rsc

feat/oauth-contribution-protocol

ping-maxwell/c-ping-maxwell/fix-kysely-adapter-core-utils-string-resolution-68c5

temp/server-only-test

2026-05-31/refactor/kysely-joins-json-helpers

2026-04-29/feat/google-include-granted-scopes

2026-04-29/fix/oauth-account-scope-semantics

fix/oauth-callback-path-declarative

2026-05-31/fix/sqlite-dialect-affected-rows

fix/next-cookie-separator

2026-05-29/fix/last-login-method-cookie-prefix

feat/oauth-provider-custom-subject

ping-maxwell/c-ping-maxwell/fix-error-link-apostrophe-f89a

client-assertions-main

2026-05-15/ci/fix-sqlite-abi-mismatch

2026-05-15/fix/organization-team-add-cascade

2026-05-15/fix/parse-set-cookie-value-validation

2026-05-13/feat/captcha-wildcard-endpoints

fix/i18n-before-hook-translation

fix/disable-migration-generate

2026-05-10/fix/cookie-drain-order

2026-05-10/feat/hooks-finally

2026-05-09/fix/cookie-drain-order

2026-05-09/feat/hooks-finally

2026-05-08/feat/register-before-send

fix/stripe/subscription-data-merge

2026-05-01/chore/pnpm-v11-harden

chore/pnpm-v11

2026-04-27/fix/nextcookies-idempotent-writes

2026-04-26/fix/harden-proxy-host-validation

2026-04-26/refactor/stripe-callback-signature-cleanup

2026-04-26/fix/stripe-subscription-callback-timing

2026-04-11/fix/sveltekit-app-modules

feat/open-api-zod-contract

feat/oauth-idp-initiated-bounce

2026-04-21/fix/oauth-rfc-input-validation

fix/two-factor-identity-guard

fix/resource

feat/emailpassword-authorize

feat/oauth-provider-at-hash-v2

fix/release-grep-fallback

claude/address-review-comments-JhFLr

feat/async-auth

fix/two-factor-totp-verified-enrollment

feat/plugin-ui

codex/blog-1-6-release-post

2026-04-06/fix/type-any-guards

2026-04-05/chore/downgrade-better-call

2026-04-04/ci/skip-vercel-fork-prs

2026-03-28/ci/add-autofix-ci

chore/release-preview-script

himself65/2026/02/19/role

2026-03-20/docs/improve-website

2026-03-20/fix/anonymous-onlinkaccount-expo

2026-02-17/fix/anonymous-link-state

fix/8607-saml-inresponseto

fix/8549-scim-patch-noop

v1.4.x

refactor/migration-snapshot-tests

worktree-magic-link-additional-data

chore/migrate-build-to-rollup

worktree-fix-dynamic-baseurl-8447

2026-03-06/chore/public-api-check

fix/close-8156-regression-test

fix/secondary-storage-json-error-handling

himself65/verification-namespace

cursor/issue-8307-validation-79a3

himself65/2026/01/30/error-mdx

v1.4.x-staging

fix/email-otp-user

fix/restrict-full-organization-access-roles

himself65/2026/02/12/count

himself65/2026/02/04/define-plugin

2026-02-04/feat/add-pluralize

cursor/better-auth-js-integration-ec21

cursor/expo-state-mismatch-394c

2026-02-01/fix/org-update-role-sync-members

cursor/issue-7607-investigation-e146

cursor/email-generation-helper-0ff6

himself65/2026/01/21/avoid-spread-operator

himself65/2026/01/14/cli

claude/slack-add-docs-pr-NMvgO

claude/slack-add-advanced-useplural-WHKYL

feat/hooks-pos

feat/2fa-phone

feat/2fa

fix/rotation

fix/username-check

v1.3.x

refactor/organization

feat/multiple-client-ids-social-providers

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/better-auth#1471