github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #6393] [MERGED] fix: chunk account data cookie #14883

New Issue
Closed
opened 2026-04-13 09:41:01 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 09:41:01 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/6393
Author: @jslno
Created: 11/28/2025
Status: ✅ Merged
Merged: 11/30/2025
Merged by: @Bekacru

Base: canary ← Head: 11-28-2025/chunk-account-data-cookie

📝 Commits (10+)

  • 2c96023 feat: chunk account data cookie
  • ff1ba62 chore: fix linting
  • 15a767a Merge branch 'canary' into 11-28-2025/chunk-account-data-cookie
  • 007885f chore: cleanup
  • edce449 refactor: add getAccountCookie helper
  • db46aa1 chore: add test for not chunking small payloads
  • 6d3f10d Merge branch 'canary' into 11-28-2025/chunk-account-data-cookie
  • 4c68695 chore: fix linting
  • 05d7db2 chore: add test for chunking large payloads
  • 9752a29 chore: add test for encrypting account data cookie

📊 Changes

4 files changed (+391 additions, -137 deletions)

View changed files

📝 packages/better-auth/src/api/routes/account.test.ts (+237 -1)
📝 packages/better-auth/src/api/routes/account.ts (+12 -45)
📝 packages/better-auth/src/cookies/session-store.ts (+139 -77)
📝 packages/better-auth/src/oauth2/link-account.ts (+3 -14)

📄 Description

closes #6379

Summary by cubic

Chunk and JWT-encode the account data cookie with chunking support to prevent truncation and fix unreliable reads. Addresses #6379 by switching endpoints to consistent storage/decoding and cleaning stale chunks.

  • Bug Fixes
    • Store account data as a JWT payload; chunk when size exceeds ~4KB.
    • Add setAccountCookie and getAccountCookie helpers; use in OAuth link, getAccessToken, refreshToken, and accountInfo.
    • Read account data via getChunkedCookie + symmetricDecodeJWT; clean old chunks when data fits in one cookie.
    • Set a 5-minute maxAge to keep cookie small and short-lived.

Written for commit 92b24c5a95. Summary will update automatically on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/6393 **Author:** [@jslno](https://github.com/jslno) **Created:** 11/28/2025 **Status:** ✅ Merged **Merged:** 11/30/2025 **Merged by:** [@Bekacru](https://github.com/Bekacru) **Base:** `canary` ← **Head:** `11-28-2025/chunk-account-data-cookie` --- ### 📝 Commits (10+) - [`2c96023`](https://github.com/better-auth/better-auth/commit/2c96023d5a87de67c8157a543bceb852a2edc7a2) feat: chunk account data cookie - [`ff1ba62`](https://github.com/better-auth/better-auth/commit/ff1ba628ff976223ee824d517e4de0eeb44ba4a2) chore: fix linting - [`15a767a`](https://github.com/better-auth/better-auth/commit/15a767a6c87c1298362c3a50e04b878aaf25f287) Merge branch 'canary' into 11-28-2025/chunk-account-data-cookie - [`007885f`](https://github.com/better-auth/better-auth/commit/007885f4d62d3b99bb5996ce61f1c51169c4adf2) chore: cleanup - [`edce449`](https://github.com/better-auth/better-auth/commit/edce449d975c6a3664406cb1e1c076edcb6a8acb) refactor: add `getAccountCookie` helper - [`db46aa1`](https://github.com/better-auth/better-auth/commit/db46aa1b1a7f87a1b0707ad245e293155d2c8fbd) chore: add test for not chunking small payloads - [`6d3f10d`](https://github.com/better-auth/better-auth/commit/6d3f10d5949d3bd638357f1f905683cdc992b99f) Merge branch 'canary' into 11-28-2025/chunk-account-data-cookie - [`4c68695`](https://github.com/better-auth/better-auth/commit/4c686951a0b2c230cd642872bb8cad5bafe7faac) chore: fix linting - [`05d7db2`](https://github.com/better-auth/better-auth/commit/05d7db26adac8ab51a3343e689c337cd28ca0d13) chore: add test for chunking large payloads - [`9752a29`](https://github.com/better-auth/better-auth/commit/9752a29db7e43144b8539f0276e304405a42ae53) chore: add test for encrypting account data cookie ### 📊 Changes **4 files changed** (+391 additions, -137 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/api/routes/account.test.ts` (+237 -1) 📝 `packages/better-auth/src/api/routes/account.ts` (+12 -45) 📝 `packages/better-auth/src/cookies/session-store.ts` (+139 -77) 📝 `packages/better-auth/src/oauth2/link-account.ts` (+3 -14) </details> ### 📄 Description closes #6379 <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Chunk and JWT-encode the account data cookie with chunking support to prevent truncation and fix unreliable reads. Addresses #6379 by switching endpoints to consistent storage/decoding and cleaning stale chunks. - **Bug Fixes** - Store account data as a JWT payload; chunk when size exceeds ~4KB. - Add setAccountCookie and getAccountCookie helpers; use in OAuth link, getAccessToken, refreshToken, and accountInfo. - Read account data via getChunkedCookie + symmetricDecodeJWT; clean old chunks when data fits in one cookie. - Set a 5-minute maxAge to keep cookie small and short-lived. <sup>Written for commit 92b24c5a95706a3bd0fb741f3a763e4f0b658b71. Summary will update automatically on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-13 09:41:01 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#14883
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?