github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 16:11:53 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #4022] Organization delete does not throw an error on an invalid session #18430

New Issue
Closed
opened 2026-04-15 16:53:00 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-04-15 16:53:00 -05:00
Owner
Copy Link

Originally created by @Josehm1999 on GitHub (Aug 15, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/4022

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

  1. Create a Hono backend
  2. Enable better-auth endpoints
  3. Use organization/delete method without a valid session from the openAPI plugin interface or API client.

Current vs. Expected behavior

I expected to be returned a 401 UNAUTHORIZED error but got a 200 OK response with a null body.
Testing done from the openAPI plugin.
Image
And it also happens from other API clients:
Image
Both times making sure no session cookies are set.

What version of Better Auth are you using?

1.3.4

System info

System:
    OS: Linux 6.14 Arch Linux
    CPU: (12) x64 Intel(R) Core(TM) i5-10400F CPU @ 2.90GHz
    Memory: 9.67 GB / 15.52 GB
    Container: Yes
    Shell: 5.9 - /usr/bin/zsh

Which area(s) are affected? (Select all that apply)

Backend, Client

Auth config (if applicable)

import { betterAuth } from "better-auth";
import { LibsqlDialect } from "@libsql/kysely-libsql";
import { apiKey, openAPI, organization } from "better-auth/plugins";

const dialect = new LibsqlDialect({
	url: process.env.DATABASE_URL || "",
	authToken: process.env.AUTH_TOKEN || "",
});

export const auth = betterAuth({
	database: {
		dialect,
		type: "sqlite",
	},
	emailAndPassword: {
		enabled: true,
	},
	plugins: [openAPI(), apiKey(), organization()],
});

Additional context

The issue can be reproduced both online and locally and it's happening both in Zen Browser and Chrome. Also looking for similar issues i found the issue #1746 but the problem was related to the organization/update method. The bug is similar if not the same. The delete method for organizations in 'packages/better-auth/src/plugins/organization/routes/crud-org.ts' is not properly throwing errors.

Image
Originally created by @Josehm1999 on GitHub (Aug 15, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/4022 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce 1. Create a Hono backend 2. Enable better-auth endpoints 3. Use organization/delete method without a valid session from the openAPI plugin interface or API client. ### Current vs. Expected behavior I expected to be returned a 401 UNAUTHORIZED error but got a 200 OK response with a null body. Testing done from the openAPI plugin. <img width="1362" height="588" alt="Image" src="https://github.com/user-attachments/assets/2d2b8f42-4f3d-452c-95aa-bc1bcd757075" /> And it also happens from other API clients: <img width="1400" height="352" alt="Image" src="https://github.com/user-attachments/assets/7ddaed0b-b28a-409a-85ae-04f54fbf8918" /> Both times making sure no session cookies are set. ### What version of Better Auth are you using? 1.3.4 ### System info ```bash System: OS: Linux 6.14 Arch Linux CPU: (12) x64 Intel(R) Core(TM) i5-10400F CPU @ 2.90GHz Memory: 9.67 GB / 15.52 GB Container: Yes Shell: 5.9 - /usr/bin/zsh ``` ### Which area(s) are affected? (Select all that apply) Backend, Client ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth"; import { LibsqlDialect } from "@libsql/kysely-libsql"; import { apiKey, openAPI, organization } from "better-auth/plugins"; const dialect = new LibsqlDialect({ url: process.env.DATABASE_URL || "", authToken: process.env.AUTH_TOKEN || "", }); export const auth = betterAuth({ database: { dialect, type: "sqlite", }, emailAndPassword: { enabled: true, }, plugins: [openAPI(), apiKey(), organization()], }); ``` ### Additional context The issue can be reproduced both online and locally and it's happening both in Zen Browser and Chrome. Also looking for similar issues i found the issue #1746 but the problem was related to the organization/update method. The bug is similar if not the same. The delete method for organizations in 'packages/better-auth/src/plugins/organization/routes/crud-org.ts' is not properly throwing errors. <img width="696" height="678" alt="Image" src="https://github.com/user-attachments/assets/bea9fa4c-f4cb-4815-a45a-852455812500" />
GiteaMirror added the lockedbug labels 2026-04-15 16:53:00 -05:00
GiteaMirror commented 2026-04-15 16:53:01 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Aug 15, 2025):

Hi @Josehm1999! I'm Dosu and I’m helping the better-auth team.

You’re right—this is a bug. The organization/delete endpoint currently returns ctx.json(null, { status: 401 }) when there’s no valid session, but this does not reliably set the HTTP status code to 401 in all environments, especially with Hono and the openAPI plugin. Instead, you get a 200 OK with a null body, which is not the expected behavior for unauthorized access see code.

The recommended fix is to throw an APIError with a 401 status when the session is missing, rather than returning a JSON response. This approach aligns with Better Auth’s documented error handling, which expects endpoints to throw errors for unauthorized requests see docs.

Workaround:
In your local code, update the session check in the organization/delete handler to:

if (!session) {
  throw new APIError("UNAUTHORIZED", { status: 401 });
}

This will ensure the correct HTTP status code is returned.

If you’re using the package as-is, you may need to patch this locally or wait for an upstream fix. This issue is not currently tracked for organization/delete, but it’s similar to what was previously reported for organization/update.

Let me know if you need help with a patch or want more details on error handling!

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

<!-- gh-comment-id:3190777503 --> @dosubot[bot] commented on GitHub (Aug 15, 2025): <!-- Greeting --> Hi @Josehm1999! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the better-auth team. <!-- Answer --> You’re right—this is a bug. The organization/delete endpoint currently returns `ctx.json(null, { status: 401 })` when there’s no valid session, but this does not reliably set the HTTP status code to 401 in all environments, especially with Hono and the openAPI plugin. Instead, you get a 200 OK with a null body, which is not the expected behavior for unauthorized access [see code](https://github.com/better-auth/better-auth/blob/dbaae0ab2bc39de87dd4719e37f48e4b94ea2262/packages/better-auth/src/plugins/organization/routes/crud-org.ts). The recommended fix is to throw an `APIError` with a 401 status when the session is missing, rather than returning a JSON response. This approach aligns with Better Auth’s documented error handling, which expects endpoints to throw errors for unauthorized requests [see docs](https://better-auth.com/docs/concepts/api). **Workaround:** In your local code, update the session check in the organization/delete handler to: ```typescript if (!session) { throw new APIError("UNAUTHORIZED", { status: 401 }); } ``` This will ensure the correct HTTP status code is returned. If you’re using the package as-is, you may need to patch this locally or wait for an upstream fix. This issue is not currently tracked for organization/delete, but it’s similar to what was previously reported for organization/update. Let me know if you need help with a patch or want more details on error handling! <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/a28b37ff-4b63-4b44-8a02-4edafed50523?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/a28b37ff-4b63-4b44-8a02-4edafed50523?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/a28b37ff-4b63-4b44-8a02-4edafed50523?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/a28b37ff-4b63-4b44-8a02-4edafed50523?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/a28b37ff-4b63-4b44-8a02-4edafed50523?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/a28b37ff-4b63-4b44-8a02-4edafed50523?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/a28b37ff-4b63-4b44-8a02-4edafed50523?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/4022)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#18430
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?