github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 14:21:55 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #6248] [CLOSED] Fix: Multi-Session Plugin Creating Duplicate Cookies for Same Account #14793

New Issue
Closed
opened 2026-04-13 09:38:30 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 09:38:30 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/6248
Author: @Adityakk9031
Created: 11/23/2025
Status: ❌ Closed

Base: canary ← Head: #6184

📝 Commits (7)

📊 Changes

2 files changed (+175 additions, -70 deletions)

View changed files

📝 packages/better-auth/src/cookies/cookie-utils.ts (+96 -42)
📝 packages/better-auth/src/plugins/multi-session/index.ts (+79 -28)

📄 Description

<html> <html><head></head>

Pull Request: Fix Multi-Session Duplicate Cookies Issue (#6184)

🔥 Summary

This PR fixes the issue where the Multi Session plugin creates multiple cookies for the same account when signing in multiple times without logging out.

🐛 Problem

When signing into the same account repeatedly:

  • Each login would create a new _multi- cookie

  • Old session cookies were not replaced

  • User ended up with stacking duplicate sessions for the same account

This behavior contradicts expected functionality:

Only one active cookie per user should exist per device when using Multi Session.

Additionally, Set-Cookie parsing was broken for cookies with comma-separated Expires= attributes.

✅ Fix Implemented

Area Fix Description
Cookie Parsing Updated parseSetCookieHeader to support RFC-compliant parsing and handle commas in Expires dates
Multi-Session Hook Auto-remove existing multi-session cookie belonging to same user before setting new one
Session Counting Count from response + request headers to prevent off-by-one issues
Cleanup Logic Proper cookie removal on sign-out and revocation

🧪 How to Test

  1. Enable Multi Session plugin

  2. Sign in with same account 3× without signing out

  3. Open browser cookies

✔ Expected result:
Only 1 cookie remains for that user

❌ Previous bug:
3 separate _multi-{token} cookies remain

📁 Files Updated

  • packages/better-auth/src/cookies/index.ts → improved cookie parsing

  • packages/better-auth/src/plugins/multi-session/index.ts → improved session cookie behavior

🔗 Related Issue

Fixes: #6184

</html>

Summary by cubic

Fixes duplicate multi-session cookies for the same account by replacing the old cookie and improving Set-Cookie parsing. Ensures one cookie per user per device and proper cleanup; fixes #6184.

  • Bug Fixes
    • Replace existing same-user multi-session cookie before setting a new one.
    • Parse Set-Cookie headers robustly (RFC 6265), including commas in Expires.
    • Count active cookies from request and response to avoid off-by-one.
    • Clear multi-session cookies on sign-out and delete the associated sessions.

Written for commit 9d3a766d7c. Summary will update automatically on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/6248 **Author:** [@Adityakk9031](https://github.com/Adityakk9031) **Created:** 11/23/2025 **Status:** ❌ Closed **Base:** `canary` ← **Head:** `#6184` --- ### 📝 Commits (7) - [`4230098`](https://github.com/better-auth/better-auth/commit/4230098a965bbff3daecccef25203cf4a2b26852) Fix: Multi-Session Plugin Creating Duplicate Cookies for Same Account - [`96a7d5f`](https://github.com/better-auth/better-auth/commit/96a7d5f9e9dcffef3b5de5a561a3f7f955ec4ab4) Update index.ts - [`4704ac2`](https://github.com/better-auth/better-auth/commit/4704ac24f8449f6bb4cb17b3659df36d0a60ffda) Update cookie-utils.ts - [`3510013`](https://github.com/better-auth/better-auth/commit/35100139ee66b858f6a15ff8553f44415e717a69) update - [`2cd0a9e`](https://github.com/better-auth/better-auth/commit/2cd0a9e380abefd0806390d887f2dd87663a76bc) Update index.ts - [`418fcc5`](https://github.com/better-auth/better-auth/commit/418fcc518cd3348ad33b9437126e8cd32a61a648) Merge branch 'canary' into #6184 - [`9d3a766`](https://github.com/better-auth/better-auth/commit/9d3a766d7ca009bef483438eaa6dde723479d8ee) Merge branch 'canary' into #6184 ### 📊 Changes **2 files changed** (+175 additions, -70 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/cookies/cookie-utils.ts` (+96 -42) 📝 `packages/better-auth/src/plugins/multi-session/index.ts` (+79 -28) </details> ### 📄 Description <html> <body> <!--StartFragment--><html><head></head><body><h1>Pull Request: Fix Multi-Session Duplicate Cookies Issue (#6184)</h1> <h2>🔥 Summary</h2> <p>This PR fixes the issue where the <strong>Multi Session plugin</strong> creates <strong>multiple cookies for the same account</strong> when signing in multiple times without logging out.</p> <hr> <h2>🐛 Problem</h2> <p>When signing into the same account repeatedly:</p> <ul> <li> <p>Each login would create <strong>a new <code inline="">_multi-</code> cookie</strong></p> </li> <li> <p>Old session cookies <strong>were not replaced</strong></p> </li> <li> <p>User ended up with <strong>stacking duplicate sessions</strong> for the same account</p> </li> </ul> <p>This behavior contradicts expected functionality:</p> <blockquote> <p>Only <strong>one active cookie per user</strong> should exist per device when using Multi Session.</p> </blockquote> <p>Additionally, <code inline="">Set-Cookie</code> parsing was broken for cookies with comma-separated <code inline="">Expires=</code> attributes.</p> <hr> <h2>✅ Fix Implemented</h2> Area | Fix Description -- | -- Cookie Parsing | Updated parseSetCookieHeader to support RFC-compliant parsing and handle commas in Expires dates Multi-Session Hook | Auto-remove existing multi-session cookie belonging to same user before setting new one Session Counting | Count from response + request headers to prevent off-by-one issues Cleanup Logic | Proper cookie removal on sign-out and revocation <hr> <h2>🧪 How to Test</h2> <ol> <li> <p>Enable Multi Session plugin</p> </li> <li> <p>Sign in with same account 3× without signing out</p> </li> <li> <p>Open browser cookies</p> </li> </ol> <p>✔ Expected result:<br> Only <strong>1</strong> cookie remains for that user</p> <p>❌ Previous bug:<br> 3 separate <code inline="">_multi-{token}</code> cookies remain</p> <hr> <h2>📁 Files Updated</h2> <ul> <li> <p><code inline="">packages/better-auth/src/cookies/index.ts</code> → improved cookie parsing</p> </li> <li> <p><code inline="">packages/better-auth/src/plugins/multi-session/index.ts</code> → improved session cookie behavior</p> </li> </ul> <hr> <h2>🔗 Related Issue</h2> <p>Fixes: #6184</p> <hr> </body> </html> <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Fixes duplicate multi-session cookies for the same account by replacing the old cookie and improving Set-Cookie parsing. Ensures one cookie per user per device and proper cleanup; fixes #6184. - **Bug Fixes** - Replace existing same-user multi-session cookie before setting a new one. - Parse Set-Cookie headers robustly (RFC 6265), including commas in Expires. - Count active cookies from request and response to avoid off-by-one. - Clear multi-session cookies on sign-out and delete the associated sessions. <sup>Written for commit 9d3a766d7ca009bef483438eaa6dde723479d8ee. Summary will update automatically on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-13 09:38:30 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#14793
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?