github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #5930] Bearer set-auth-token is actually a decoded uri component of session token #19009

New Issue
Closed
opened 2026-04-15 17:46:14 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-15 17:46:14 -05:00
Owner
Copy Link

Originally created by @mlazuardy on GitHub (Nov 12, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/5930

Is this suited for github?

  • Yes, this is suited for github

Is your feature request related to a problem? Please describe.

this is probably a question rather than a feat or issue.

i found out that in the bearer plugin the session token / set-auth-token can be use by encode the session token using encodeURIComponent.I wonder why this can't be done by the authClient by automatically put it in the headers or maybe improve the doc by reading the "session_token" instead of creating local storage/ new cookie for the bearer token?

Describe the solution you'd like

To automatically use session token by using encodeURIComponent(session_token) or change the docs by reading the existing session token and pass to the Authorization headers

Describe alternatives you've considered

Either update the docs or make session token automatically read the session token (is possible or by declaring options in the auth client)

Additional context

No response

Originally created by @mlazuardy on GitHub (Nov 12, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/5930 ### Is this suited for github? - [ ] Yes, this is suited for github ### Is your feature request related to a problem? Please describe. this is probably a question rather than a feat or issue. i found out that in the bearer plugin the session token / `set-auth-token` can be use by encode the session token using `encodeURIComponent`.I wonder why this can't be done by the authClient by automatically put it in the headers or maybe improve the doc by reading the "session_token" instead of creating local storage/ new cookie for the bearer token? ### Describe the solution you'd like To automatically use session token by using `encodeURIComponent(session_token)` or change the docs by reading the existing session token and pass to the Authorization headers ### Describe alternatives you've considered Either update the docs or make session token automatically read the session token (is possible or by declaring options in the auth client) ### Additional context _No response_
GiteaMirror added the locked label 2026-04-15 17:46:14 -05:00
GiteaMirror commented 2026-04-15 17:46:16 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Nov 12, 2025):

Hi there! Thanks for raising this. Currently, the Bearer plugin returns the session token in a format that’s URL-encoded via encodeURIComponent, and the expected flow is that you retrieve and decode it before storing it (or passing it via Authorization headers). This design gives you full flexibility in how you want to handle token storage and header injection. That said, you can simplify your setup by customizing your authClient's fetchOptions to automatically decode and add the token to the Authorization header. For example, you might modify the onSuccess hook to decode the token and then set up a global header for subsequent requests [1].

Would an option to configure this automatically via a client option be helpful for your workflow? tag @better-auth-agent if you would like an answer from the Agent

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3521942402 --> @better-auth-agent[bot] commented on GitHub (Nov 12, 2025): Hi there! Thanks for raising this. Currently, the Bearer plugin returns the session token in a format that’s URL-encoded via encodeURIComponent, and the expected flow is that you retrieve and decode it before storing it (or passing it via Authorization headers). This design gives you full flexibility in how you want to handle token storage and header injection. That said, you can simplify your setup by customizing your authClient's fetchOptions to automatically decode and add the token to the Authorization header. For example, you might modify the onSuccess hook to decode the token and then set up a global header for subsequent requests [[1]](https://github.com/better-auth/better-auth/issues/1559). Would an option to configure this automatically via a client option be helpful for your workflow? tag @better-auth-agent if you would like an answer from the Agent <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-04-15 17:46:17 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Feb 11, 2026):

Hi, @mlazuardy. I'm Dosu, and I'm helping the better-auth team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You suggested enhancing the bearer plugin to automatically encode the session token and set it in Authorization headers.
  • The maintainer explained the current design returns a URL-encoded token, expecting users to decode and handle headers themselves for flexibility.
  • A method to customize the authClient to automate decoding and header setup was shared.
  • The maintainer asked if an automatic client option would be helpful for your workflow.
  • The issue was effectively addressed with a practical solution and clarification.

Next Steps:

  • Please let me know if this issue is still relevant to the latest version of better-auth by commenting here.
  • If I don’t hear back within 7 days, I will automatically close this issue.

Thanks for your understanding and contribution!

<!-- gh-comment-id:3885427507 --> @dosubot[bot] commented on GitHub (Feb 11, 2026): Hi, @mlazuardy. I'm [Dosu](https://dosu.dev), and I'm helping the better-auth team manage their backlog and am marking this issue as stale. **Issue Summary:** - You suggested enhancing the bearer plugin to automatically encode the session token and set it in Authorization headers. - The maintainer explained the current design returns a URL-encoded token, expecting users to decode and handle headers themselves for flexibility. - A method to customize the authClient to automate decoding and header setup was shared. - The maintainer asked if an automatic client option would be helpful for your workflow. - The issue was effectively addressed with a practical solution and clarification. **Next Steps:** - Please let me know if this issue is still relevant to the latest version of better-auth by commenting here. - If I don’t hear back within 7 days, I will automatically close this issue. Thanks for your understanding and contribution!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#19009
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?