github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-10-18 11:32:15 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #8994] feat: add skew protection header to auth fetches #16603

New Issue
Open
opened 2026-04-13 10:36:16 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 10:36:16 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/8994
Author: @brookemosby
Created: 4/6/2026
Status: 🔄 Open

Base: main ← Head: fix/vercel-skew-protection-client-fetch

📝 Commits (3)

  • 0866563 fix(client): add skew protection header to auth fetches
  • db725d4 fix(client): align skew plugin with disableDefaultFetchPlugins
  • 0572114 Merge branch 'main' into fix/vercel-skew-protection-client-fetch

📊 Changes

6 files changed (+225 additions, -2 deletions)

View changed files

➕ .changeset/pr-8994.md (+5 -0)
📝 packages/better-auth/src/client/config.ts (+4 -1)
➕ packages/better-auth/src/client/fetch-plugins.test.ts (+133 -0)
📝 packages/better-auth/src/client/fetch-plugins.ts (+66 -1)
📝 packages/better-auth/src/client/index.ts (+4 -0)
📝 packages/core/src/types/plugin-client.ts (+13 -0)

📄 Description

Pin Better Auth client-side custom fetch requests to the active deployment during rolling releases by adding x-deployment-id when skew protection is enabled. This aligns the client with Vercel skew-protection environment semantics and prevents auth endpoint drift during NextAuth-to-BetterAuth migrations.

Summary by cubic

Pin Better Auth client fetches to the active Vercel deployment during rolling releases by adding the x-deployment-id header when skew protection is enabled. This prevents auth endpoint drift during NextAuth-to-BetterAuth migrations.

  • Bug Fixes
    • Added a default vercelSkewProtectionPlugin to the better-auth client. Resolves the deployment ID from globalThis.NEXT_DEPLOYMENT_ID, data-dpl-id, or VERCEL_DEPLOYMENT_ID/NEXT_DEPLOYMENT_ID, and sets x-deployment-id unless already present. Runs only when default fetch plugins are enabled.
    • Gating and DX: opt out with disableSkewProtection or disableDefaultFetchPlugins; respects VERCEL_SKEW_PROTECTION_ENABLED. Exported vercelSkewProtectionPlugin and resolveDeploymentIdForSkewProtection, documented options in BetterAuthClientOptions, and added tests for resolution, header behavior, gating, and env cleanup.

Written for commit 0572114c02. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/8994 **Author:** [@brookemosby](https://github.com/brookemosby) **Created:** 4/6/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `fix/vercel-skew-protection-client-fetch` --- ### 📝 Commits (3) - [`0866563`](https://github.com/better-auth/better-auth/commit/08665637ff7acbf1738a9ed3b099343e00bcba21) fix(client): add skew protection header to auth fetches - [`db725d4`](https://github.com/better-auth/better-auth/commit/db725d4a9298b231957a54ef72932be1ca8bbfc9) fix(client): align skew plugin with disableDefaultFetchPlugins - [`0572114`](https://github.com/better-auth/better-auth/commit/0572114c02c59a3a5592a76af7d61aed4450374e) Merge branch 'main' into fix/vercel-skew-protection-client-fetch ### 📊 Changes **6 files changed** (+225 additions, -2 deletions) <details> <summary>View changed files</summary> ➕ `.changeset/pr-8994.md` (+5 -0) 📝 `packages/better-auth/src/client/config.ts` (+4 -1) ➕ `packages/better-auth/src/client/fetch-plugins.test.ts` (+133 -0) 📝 `packages/better-auth/src/client/fetch-plugins.ts` (+66 -1) 📝 `packages/better-auth/src/client/index.ts` (+4 -0) 📝 `packages/core/src/types/plugin-client.ts` (+13 -0) </details> ### 📄 Description Pin Better Auth client-side custom fetch requests to the active deployment during rolling releases by adding x-deployment-id when skew protection is enabled. This aligns the client with Vercel skew-protection environment semantics and prevents auth endpoint drift during NextAuth-to-BetterAuth migrations. <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Pin Better Auth client fetches to the active Vercel deployment during rolling releases by adding the `x-deployment-id` header when skew protection is enabled. This prevents auth endpoint drift during NextAuth-to-BetterAuth migrations. - **Bug Fixes** - Added a default `vercelSkewProtectionPlugin` to the `better-auth` client. Resolves the deployment ID from `globalThis.NEXT_DEPLOYMENT_ID`, `data-dpl-id`, or `VERCEL_DEPLOYMENT_ID`/`NEXT_DEPLOYMENT_ID`, and sets `x-deployment-id` unless already present. Runs only when default fetch plugins are enabled. - Gating and DX: opt out with `disableSkewProtection` or `disableDefaultFetchPlugins`; respects `VERCEL_SKEW_PROTECTION_ENABLED`. Exported `vercelSkewProtectionPlugin` and `resolveDeploymentIdForSkewProtection`, documented options in `BetterAuthClientOptions`, and added tests for resolution, header behavior, gating, and env cleanup. <sup>Written for commit 0572114c02c59a3a5592a76af7d61aed4450374e. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-13 10:36:16 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#16603