github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 08:01:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #4895] simplewebauthn helper package conflict in next build, and suggested config resolution changes #18732

New Issue
Closed
opened 2026-04-15 17:21:43 -05:00 by GiteaMirror · 3 comments
GiteaMirror commented 2026-04-15 17:21:43 -05:00
Owner
Copy Link

Originally created by @airpi017 on GitHub (Sep 25, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/4895

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

BACKGROUND
Implemented passkey flow based on passkey plugin semantics.
Route for auth worked for session via OTP and email, didn't work for passkeys.

`app/api/auth/[...all]/route.ts

"use server-only";

import auth from "~/server/auth/config";
import { toNextJsHandler } from "better-auth/next-js";

export const { GET, POST } = toNextJsHandler(auth.handler);
`

Currently attempting tRPC and using simplewebauthn methods directly.

`
import {
generateRegistrationOptions,
verifyRegistrationResponse,
generateAuthenticationOptions,
verifyAuthenticationResponse,
} from "@simplewebauthn/server";

A. Build errors experienced with either i) passkey plugin semantics or ii) simplewebauthn calls:
`
...

Import trace for requested module:
./node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js
./node_modules/@simplewebauthn/server/esm/index.js
./node_modules/better-auth/dist/plugins/passkey/index.mjs
./src/server/auth/config.ts
./src/app/api/auth/[...all]/route.ts

./node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js
Attempted import error: 'verifyAttestationAndroidSafetyNet' is not exported from './verifications/verifyAttestationAndroidSafetyNet.js' (imported as 'verifyAttestationAndroidSafetyNet').

Import trace for requested module:
./node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js
./node_modules/@simplewebauthn/server/esm/index.js
./node_modules/better-auth/dist/plugins/passkey/index.mjs
./src/server/auth/config.ts
./src/app/api/auth/[...all]/route.ts

./node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js
Attempted import error: 'verifyAttestationAndroidKey' is not exported from './verifications/verifyAttestationAndroidKey.js' (imported as 'verifyAttestationAndroidKey').

Import trace for requested module:
./node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js
./node_modules/@simplewebauthn/server/esm/index.js
./node_modules/better-auth/dist/plugins/passkey/index.mjs
./src/server/auth/config.ts
./src/app/api/auth/[...all]/route.ts

Build failed because of webpack errors
`
B. Config changes suggested:

  1. Version Alignment: Installed the exact same versions that better-auth uses:
  • @simplewebauthn/server@13.2.1
  • @simplewebauthn/browser@13.2.0
  1. Package.json Resolutions:
    Added resolutions to force versions:
"resolutions": {
     "@simplewebauthn/server": "13.2.1",
     "@simplewebauthn/browser": "13.2.0"
   }
`
3. Webpack Externals in next.config.ts: 
  Added webpack configuration to prevent bundling conflicts:
`
webpack: (config, { isServer }) => {
    ...
    
    // Prevent better-auth from bundling its own @simplewebauthn packages
    if (isServer) {
      config.externals = config.externals || [];
      config.externals.push({
        '@simplewebauthn/server': 'commonjs @simplewebauthn/server',
        '@simplewebauthn/browser': 'commonjs @simplewebauthn/browser',
      });
    }
    
    return config;
  },
`

Simplewebauthn errors removed from build log now.

This information may help with some changes to the referencing of simplewebauthn in better-auth/plugin/passkey.

### Current vs. Expected behavior

simplewebauthn package rolled into better-auth was unable to correctly identify import helper functions. Caused conflict and subsequent build failures.

A. Build errors experienced with either i) passkey plugin semantics or ii) simplewebauthn calls:
`
...

Import trace for requested module:
./node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js
./node_modules/@simplewebauthn/server/esm/index.js
./node_modules/better-auth/dist/plugins/passkey/index.mjs
./src/server/auth/config.ts
./src/app/api/auth/[...all]/route.ts

./node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js
Attempted import error: 'verifyAttestationAndroidSafetyNet' is not exported from './verifications/verifyAttestationAndroidSafetyNet.js' (imported as 'verifyAttestationAndroidSafetyNet').

Import trace for requested module:
./node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js
./node_modules/@simplewebauthn/server/esm/index.js
./node_modules/better-auth/dist/plugins/passkey/index.mjs
./src/server/auth/config.ts
./src/app/api/auth/[...all]/route.ts

./node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js
Attempted import error: 'verifyAttestationAndroidKey' is not exported from './verifications/verifyAttestationAndroidKey.js' (imported as 'verifyAttestationAndroidKey').

Import trace for requested module:
./node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js
./node_modules/@simplewebauthn/server/esm/index.js
./node_modules/better-auth/dist/plugins/passkey/index.mjs
./src/server/auth/config.ts
./src/app/api/auth/[...all]/route.ts

B. suggested config changes fixed the errors experienced.

### What version of Better Auth are you using?

1.4.0-beta.3

### System info

```bash
{
  "system": {
    "platform": "linux", //Mint Linux
    "arch": "x64",
    "version": "#71-Ubuntu SMP PREEMPT_DYNAMIC Tue Jul 22 16:52:38 UTC 2025",
    "release": "6.8.0-71-generic",
    "cpuCount": 32,
    "cpuModel": "13th Gen Intel(R) Core(TM) i9-13980HX",
    "totalMemory": "62.50 GB",
    "freeMemory": "44.64 GB"
  },
  "node": {
    "version": "v22.17.1",
    "env": "development"
  },
  "packageManager": {
    "name": "npm",
    "version": "11.6.0"
  },
  "frameworks": [
    {
      "name": "next",
      "version": "^15.2.3"
    },
    {
      "name": "react",
      "version": "^19.0.0"
    }
  ],
  "databases": [
    {
      "name": "drizzle",
      "version": "^0.44.4"
    },
    {
      "name": "@planetscale/database",
      "version": "^1.19.0"
    }
  ],
  "betterAuth": {
    "version": "0.1.0",
    "config": null
  }
}

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

"use server-only";

import { betterAuth } from "better-auth";
import { drizzleAdapter } from "better-auth/adapters/drizzle";
import { nextCookies } from "better-auth/next-js";
// Note: Using basic better-auth configuration for now
// In production, you would add plugins for email/password and passkey
import { db } from "~/db";
import { user, session, account, verification, passkey } from "~/db/auth-schema";

...

const auth = betterAuth({
  database: drizzleAdapter(db, {
    provider: "mysql",
    schema: {
      user,
      session,
      account,
      verification,
      passkey,
    },
  }),
  
  secret: env.BETTER_AUTH_SECRET,
  baseURL: env.BETTER_AUTH_URL,
  
  // Basic configuration for now
  // In production, add emailAndPassword and passkey plugins
  plugins: [
    nextCookies(),
    // Passkey functionality removed - will be implemented directly with @simplewebauthn
  ],
  session: {
    expiresIn: SECURITY_CONFIG.SESSION_DURATION,
    updateAge: 24 * 60 * 60 * 1000, // 24 hours
    cookieCache: {
      enabled: true,
      maxAge: 5 * 60 * 1000, // 5 minutes
    },
  },
  
  user: {
    additionalFields: {
      emailVerified: {
        type: "boolean",
        defaultValue: false,
      },
      passkeyRegistered: {
        type: "boolean", 
        defaultValue: false,
      },
      magicCodeVerified: {
        type: "boolean",
        defaultValue: false,
      },
    },
  },
  
  advanced: {
    generateId: () => crypto.randomUUID(),
    crossSubdomainCookies: {
      enabled: false,
    },
  },
  
  trustedOrigins: [
    process.env.NODE_ENV === "production" ? "https://web.site" : "http://localhost:3000",
  ],
});

export { SECURITY_CONFIG };
export type Auth = typeof auth;
export default auth;

Additional context

Installed various versions of better-auth and the same helper import errors occurred. Appears to be the packaging of simplewebauthn within better-auth is missing something.

Everything in better-auth package seems to checkout, so excluding simplewebauthn there and forcing use of simplewebauthn directly, fixed it for me atm. A curly one indeed... good luck :)

Originally created by @airpi017 on GitHub (Sep 25, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/4895 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce BACKGROUND Implemented passkey flow based on passkey plugin semantics. Route for auth worked for session via OTP and email, didn't work for passkeys. `app/api/auth/[...all]/route.ts "use server-only"; import auth from "~/server/auth/config"; import { toNextJsHandler } from "better-auth/next-js"; export const { GET, POST } = toNextJsHandler(auth.handler); ` Currently attempting tRPC and using simplewebauthn methods directly. ` import { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse, } from "@simplewebauthn/server"; A. Build errors experienced with either i) passkey plugin semantics or ii) simplewebauthn calls: ` ... Import trace for requested module: ./node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js ./node_modules/@simplewebauthn/server/esm/index.js ./node_modules/better-auth/dist/plugins/passkey/index.mjs ./src/server/auth/config.ts ./src/app/api/auth/[...all]/route.ts ./node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js Attempted import error: 'verifyAttestationAndroidSafetyNet' is not exported from './verifications/verifyAttestationAndroidSafetyNet.js' (imported as 'verifyAttestationAndroidSafetyNet'). Import trace for requested module: ./node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js ./node_modules/@simplewebauthn/server/esm/index.js ./node_modules/better-auth/dist/plugins/passkey/index.mjs ./src/server/auth/config.ts ./src/app/api/auth/[...all]/route.ts ./node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js Attempted import error: 'verifyAttestationAndroidKey' is not exported from './verifications/verifyAttestationAndroidKey.js' (imported as 'verifyAttestationAndroidKey'). Import trace for requested module: ./node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js ./node_modules/@simplewebauthn/server/esm/index.js ./node_modules/better-auth/dist/plugins/passkey/index.mjs ./src/server/auth/config.ts ./src/app/api/auth/[...all]/route.ts > Build failed because of webpack errors ` B. Config changes suggested: 1. Version Alignment: Installed the exact same versions that better-auth uses: * @simplewebauthn/server@13.2.1 * @simplewebauthn/browser@13.2.0 2. Package.json Resolutions: Added resolutions to force versions: ``` "resolutions": { "@simplewebauthn/server": "13.2.1", "@simplewebauthn/browser": "13.2.0" } ` 3. Webpack Externals in next.config.ts: Added webpack configuration to prevent bundling conflicts: ` webpack: (config, { isServer }) => { ... // Prevent better-auth from bundling its own @simplewebauthn packages if (isServer) { config.externals = config.externals || []; config.externals.push({ '@simplewebauthn/server': 'commonjs @simplewebauthn/server', '@simplewebauthn/browser': 'commonjs @simplewebauthn/browser', }); } return config; }, ` Simplewebauthn errors removed from build log now. This information may help with some changes to the referencing of simplewebauthn in better-auth/plugin/passkey. ### Current vs. Expected behavior simplewebauthn package rolled into better-auth was unable to correctly identify import helper functions. Caused conflict and subsequent build failures. A. Build errors experienced with either i) passkey plugin semantics or ii) simplewebauthn calls: ` ... Import trace for requested module: ./node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js ./node_modules/@simplewebauthn/server/esm/index.js ./node_modules/better-auth/dist/plugins/passkey/index.mjs ./src/server/auth/config.ts ./src/app/api/auth/[...all]/route.ts ./node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js Attempted import error: 'verifyAttestationAndroidSafetyNet' is not exported from './verifications/verifyAttestationAndroidSafetyNet.js' (imported as 'verifyAttestationAndroidSafetyNet'). Import trace for requested module: ./node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js ./node_modules/@simplewebauthn/server/esm/index.js ./node_modules/better-auth/dist/plugins/passkey/index.mjs ./src/server/auth/config.ts ./src/app/api/auth/[...all]/route.ts ./node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js Attempted import error: 'verifyAttestationAndroidKey' is not exported from './verifications/verifyAttestationAndroidKey.js' (imported as 'verifyAttestationAndroidKey'). Import trace for requested module: ./node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js ./node_modules/@simplewebauthn/server/esm/index.js ./node_modules/better-auth/dist/plugins/passkey/index.mjs ./src/server/auth/config.ts ./src/app/api/auth/[...all]/route.ts B. suggested config changes fixed the errors experienced. ### What version of Better Auth are you using? 1.4.0-beta.3 ### System info ```bash { "system": { "platform": "linux", //Mint Linux "arch": "x64", "version": "#71-Ubuntu SMP PREEMPT_DYNAMIC Tue Jul 22 16:52:38 UTC 2025", "release": "6.8.0-71-generic", "cpuCount": 32, "cpuModel": "13th Gen Intel(R) Core(TM) i9-13980HX", "totalMemory": "62.50 GB", "freeMemory": "44.64 GB" }, "node": { "version": "v22.17.1", "env": "development" }, "packageManager": { "name": "npm", "version": "11.6.0" }, "frameworks": [ { "name": "next", "version": "^15.2.3" }, { "name": "react", "version": "^19.0.0" } ], "databases": [ { "name": "drizzle", "version": "^0.44.4" }, { "name": "@planetscale/database", "version": "^1.19.0" } ], "betterAuth": { "version": "0.1.0", "config": null } } ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript "use server-only"; import { betterAuth } from "better-auth"; import { drizzleAdapter } from "better-auth/adapters/drizzle"; import { nextCookies } from "better-auth/next-js"; // Note: Using basic better-auth configuration for now // In production, you would add plugins for email/password and passkey import { db } from "~/db"; import { user, session, account, verification, passkey } from "~/db/auth-schema"; ... const auth = betterAuth({ database: drizzleAdapter(db, { provider: "mysql", schema: { user, session, account, verification, passkey, }, }), secret: env.BETTER_AUTH_SECRET, baseURL: env.BETTER_AUTH_URL, // Basic configuration for now // In production, add emailAndPassword and passkey plugins plugins: [ nextCookies(), // Passkey functionality removed - will be implemented directly with @simplewebauthn ], session: { expiresIn: SECURITY_CONFIG.SESSION_DURATION, updateAge: 24 * 60 * 60 * 1000, // 24 hours cookieCache: { enabled: true, maxAge: 5 * 60 * 1000, // 5 minutes }, }, user: { additionalFields: { emailVerified: { type: "boolean", defaultValue: false, }, passkeyRegistered: { type: "boolean", defaultValue: false, }, magicCodeVerified: { type: "boolean", defaultValue: false, }, }, }, advanced: { generateId: () => crypto.randomUUID(), crossSubdomainCookies: { enabled: false, }, }, trustedOrigins: [ process.env.NODE_ENV === "production" ? "https://web.site" : "http://localhost:3000", ], }); export { SECURITY_CONFIG }; export type Auth = typeof auth; export default auth; ``` ### Additional context Installed various versions of better-auth and the same helper import errors occurred. Appears to be the packaging of simplewebauthn within better-auth is missing something. Everything in better-auth package seems to checkout, so excluding simplewebauthn there and forcing use of simplewebauthn directly, fixed it for me atm. A curly one indeed... good luck :)
GiteaMirror added the locked label 2026-04-15 17:21:43 -05:00
GiteaMirror commented 2026-04-15 17:21:44 -05:00
Author
Owner
Copy Link

@himself65 commented on GitHub (Sep 25, 2025):

In our package.json, the version is

"@simplewebauthn/browser": "^13.1.2",
"@simplewebauthn/server": "^13.1.2",
<!-- gh-comment-id:3332752846 --> @himself65 commented on GitHub (Sep 25, 2025): In our package.json, the version is ```json "@simplewebauthn/browser": "^13.1.2", "@simplewebauthn/server": "^13.1.2", ```
GiteaMirror commented 2026-04-15 17:21:44 -05:00
Author
Owner
Copy Link

@airpi017 commented on GitHub (Sep 26, 2025):

Used 13.0.0.0 for simplwebauthn doc compatibility and various other versions eg. 13.1.2 , 13.2.1 etc.. Same results.

I'll admit I use packages and am unfamiliar with building them.

Compiler errors show better-auth packsge is expecting ./<helper_function>.js shouldn't it be <better-auth_package_root>/@simplewebauthn/server/esm/<helper> /<helper_function>.js

Focusing on a single version and ignoring the whole information base of the issue might explain why the are ~5000 issues.

I can move on with these config changes and use better-auth session an simplewebathn passkey semantics.

You can close this issue if you like. I'm good

<!-- gh-comment-id:3336547792 --> @airpi017 commented on GitHub (Sep 26, 2025): Used 13.0.0.0 for simplwebauthn doc compatibility and various other versions eg. 13.1.2 , 13.2.1 etc.. Same results. I'll admit I use packages and am unfamiliar with building them. >`Compiler errors show better-auth packsge is expecting ./<helper_function>.js shouldn't it be <better-auth_package_root>/@simplewebauthn/server/esm/<helper> /<helper_function>.js` Focusing on a single version and ignoring the whole information base of the issue might explain why the are ~5000 issues. I can move on with these config changes and use better-auth session an simplewebathn passkey semantics. You can close this issue if you like. I'm good
GiteaMirror commented 2026-04-15 17:21:45 -05:00
Author
Owner
Copy Link

@himself65 commented on GitHub (Sep 26, 2025):

This issue seems invalid. Please check the lockfile and node_modules to see what exactly version you are using

I think we're not gonna support the legacy version. And in the next year, maybe make ESM only

<!-- gh-comment-id:3337303878 --> @himself65 commented on GitHub (Sep 26, 2025): This issue seems invalid. Please check the lockfile and node_modules to see what exactly version you are using I think we're not gonna support the legacy version. And in the next year, maybe make ESM only
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#18732
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?