github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

no option for successful signin to remove existing sessions #1682

New Issue
Closed
opened 2026-03-13 08:55:45 -05:00 by GiteaMirror · 4 comments
GiteaMirror commented 2026-03-13 08:55:45 -05:00
Owner
Copy Link

Originally created by @airtonix on GitHub (Aug 11, 2025).

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

  1. login
  2. be successful
  3. clear cookies from browser
  4. attempt to login again
  5. experience failure, existing session something something something db

Current vs. Expected behavior

  1. login
  2. be successful
  3. clear cookies from browser
  4. attempt to login again
  5. be successful

What version of Better Auth are you using?

1.3.5

System info

- drizzle pg via neon
- tanstack router / hono
- react-router 7

doesn't matter what happens everywhere

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  emailAndPassword: {  
    enabled: true
  },
});

Additional context

No response

Originally created by @airtonix on GitHub (Aug 11, 2025). ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce 1. login 2. be successful 3. clear cookies from browser 4. attempt to login again 5. experience failure, existing session something something something db ### Current vs. Expected behavior 1. login 2. be successful 3. clear cookies from browser 4. attempt to login again 5. be successful ### What version of Better Auth are you using? 1.3.5 ### System info ```bash - drizzle pg via neon - tanstack router / hono - react-router 7 doesn't matter what happens everywhere ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ emailAndPassword: { enabled: true }, }); ``` ### Additional context _No response_
GiteaMirror commented 2026-03-13 08:55:46 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Aug 11, 2025):

Better Auth does not automatically remove or invalidate existing sessions when a user signs in, even after cookies are cleared. When you clear cookies, the backend still has the old sessions in the database, but the client no longer has the session token, which can cause conflicts or errors on subsequent logins.

To achieve the behavior you want (removing all existing sessions on successful signin), you need to explicitly revoke sessions after signin. Better Auth provides functions like revokeSessions (to remove all sessions) and revokeOtherSessions (to remove all except the current one) that you can call after a successful login. See the session management docs for details and code examples.

There is no config option to do this automatically; you’ll need to add custom logic to call these functions after signin. The sign-in endpoints in the codebase simply create a new session and set the cookie—they do not remove or invalidate other sessions by default (source).

Example (client-side, after signin):

await authClient.revokeSessions(); // removes all sessions for the user

or

await authClient.revokeOtherSessions(); // removes all except the current session

If you want this to happen automatically, you could trigger it in your signin flow after a successful login response.

For more, see the session management documentation.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Aug 11, 2025): <!-- Answer --> Better Auth does not automatically remove or invalidate existing sessions when a user signs in, even after cookies are cleared. When you clear cookies, the backend still has the old sessions in the database, but the client no longer has the session token, which can cause conflicts or errors on subsequent logins. To achieve the behavior you want (removing all existing sessions on successful signin), you need to explicitly revoke sessions after signin. Better Auth provides functions like `revokeSessions` (to remove all sessions) and `revokeOtherSessions` (to remove all except the current one) that you can call after a successful login. See the [session management docs](https://better-auth.com/docs/concepts/session-management) for details and code examples. There is no config option to do this automatically; you’ll need to add custom logic to call these functions after signin. The sign-in endpoints in the codebase simply create a new session and set the cookie—they do not remove or invalidate other sessions by default [(source)](https://github.com/better-auth/better-auth/blob/f105f85c19aebf5c92bf3d9348f1290ef8d0c6b2/packages/better-auth/src/api/routes/sign-in.ts). Example (client-side, after signin): ```ts await authClient.revokeSessions(); // removes all sessions for the user ``` or ```ts await authClient.revokeOtherSessions(); // removes all except the current session ``` If you want this to happen automatically, you could trigger it in your signin flow after a successful login response. For more, see the [session management documentation](https://better-auth.com/docs/concepts/session-management). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/2c1ffee2-d944-4848-813b-d9fd3b5e1265?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/2c1ffee2-d944-4848-813b-d9fd3b5e1265?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/2c1ffee2-d944-4848-813b-d9fd3b5e1265?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/2c1ffee2-d944-4848-813b-d9fd3b5e1265?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/2c1ffee2-d944-4848-813b-d9fd3b5e1265?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/2c1ffee2-d944-4848-813b-d9fd3b5e1265?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/2c1ffee2-d944-4848-813b-d9fd3b5e1265?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/3939)
GiteaMirror commented 2026-03-13 08:55:46 -05:00
Author
Owner
Copy Link

@airtonix commented on GitHub (Aug 12, 2025):

@dosu Calling revokeSession after signin isn't possible because the error occurs inside the signin logic.

@airtonix commented on GitHub (Aug 12, 2025): @dosu Calling `revokeSession` after signin isn't possible because the error occurs inside the signin logic.
GiteaMirror commented 2026-03-13 08:55:47 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Aug 12, 2025):

Better Auth doesn't have a built-in way to revoke or clean up existing sessions as part of the signin process. The signin logic just creates a new session and sets the cookie; it doesn't remove or check for old sessions, even if cookies were cleared on the client. If session creation fails, you'll get a "FAILED_TO_CREATE_SESSION" error, but this isn't directly caused by leftover sessions—it's usually a problem with the session store or DB, not a session conflict. There are no extension points or hooks to inject session cleanup into the signin flow itself, so any session revocation has to be done manually, outside of the signin handler. If you need to guarantee all old sessions are removed before signin, you'd have to fork the signin endpoint or patch the logic to call a session cleanup function before creating a new session, as there's no config or plugin support for this right now reference.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Aug 12, 2025): <!-- Answer --> Better Auth doesn't have a built-in way to revoke or clean up existing sessions as part of the signin process. The signin logic just creates a new session and sets the cookie; it doesn't remove or check for old sessions, even if cookies were cleared on the client. If session creation fails, you'll get a "FAILED_TO_CREATE_SESSION" error, but this isn't directly caused by leftover sessions—it's usually a problem with the session store or DB, not a session conflict. There are no extension points or hooks to inject session cleanup into the signin flow itself, so any session revocation has to be done manually, outside of the signin handler. If you need to guarantee all old sessions are removed before signin, you'd have to fork the signin endpoint or patch the logic to call a session cleanup function before creating a new session, as there's no config or plugin support for this right now [reference](https://github.com/better-auth/better-auth/blob/95c7ee3e446e0ac66221926325297a7afa906655/packages/better-auth/src/api/routes/sign-in.ts). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/adaab57d-5cda-4981-ae6f-187af52b6c02?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/adaab57d-5cda-4981-ae6f-187af52b6c02?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/adaab57d-5cda-4981-ae6f-187af52b6c02?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/adaab57d-5cda-4981-ae6f-187af52b6c02?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/adaab57d-5cda-4981-ae6f-187af52b6c02?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/adaab57d-5cda-4981-ae6f-187af52b6c02?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/adaab57d-5cda-4981-ae6f-187af52b6c02?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/3939)
GiteaMirror commented 2026-03-13 08:55:48 -05:00
Author
Owner
Copy Link

@airtonix commented on GitHub (Nov 18, 2025):

unsatisfactory outcome tbh

@airtonix commented on GitHub (Nov 18, 2025): unsatisfactory outcome tbh
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#1682
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?