github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #6301] getAccessToken missing fields with Stateless session #19108

New Issue
Closed
opened 2026-04-15 17:53:47 -05:00 by GiteaMirror · 3 comments
GiteaMirror commented 2026-04-15 17:53:47 -05:00
Owner
Copy Link

Originally created by @ezeparziale on GitHub (Nov 25, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/6301

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

I'm using this auth.ts in statelessMode with storeAccountCookie

import { betterAuth } from "better-auth";
import { createAuthMiddleware, customSession } from "better-auth/plugins";

export const auth = betterAuth({
  plugins: [
    customSession(async ({ user, session }) => {
      console.log("user", user);
      console.log("session", session);
      const active = true;
      return {
        user: {
          ...user,
          active,
        },
        session,
      };
    }),
  ],
  socialProviders: {
    google: {
      clientId: process.env.AUTH_GOOGLE_ID as string,
      clientSecret: process.env.AUTH_GOOGLE_SECRET as string,
      accessType: "offline",
      prompt: "select_account consent",
      scopes: [
        "openid",
        "email",
        "profile",
        "https://www.googleapis.com/auth/bigquery",
        "https://www.googleapis.com/auth/drive",
        "https://www.googleapis.com/auth/devstorage.full_control",
        "https://www.googleapis.com/auth/devstorage.read_only",
        "https://www.googleapis.com/auth/devstorage.read_write",
        "https://www.googleapis.com/auth/cloud-platform",
      ].join(" "),
      redirectURI: "http://localhost:3000/api/auth/callback/google",
    },
  },
  session: {
    cookieCache: {
      enabled: true,
      maxAge: 300,
      strategy: "jwe",
      refreshCache: {
        updateAge: 60,
      },
    },
  },
  advanced: {
    oauthConfig: {
      storeStateStrategy: "cookie",
      storeAccountCookie: true,
    },
  },
  hooks: {
    after: createAuthMiddleware(async (ctx) => {}),
  },
});

In proxy o page when run:

  const a = await auth.api.getAccessToken({
    body: { providerId: "google" },
    headers: await headers(),
  });

only get some fields from Account

  • accessToken
  • accessTokenExpiresAt
  • scopes
  • IdToken

But in the cookie called better-auth.account_data has all the data

  • refreshToken is missing

Current vs. Expected behavior

Expected:

export const accountSchema = coreSchema.extend({
	providerId: z.string(),
	accountId: z.string(),
	userId: z.coerce.string(),
	accessToken: z.string().nullish(),
	refreshToken: z.string().nullish(),
	idToken: z.string().nullish(),
	/**
	 * Access token expires at
	 */
	accessTokenExpiresAt: z.date().nullish(),
	/**
	 * Refresh token expires at
	 */
	refreshTokenExpiresAt: z.date().nullish(),
	/**
	 * The scopes that the user has authorized
	 */
	scope: z.string().nullish(),
	/**
	 * Password is only stored in the credential provider
	 */
	password: z.string().nullish(),
});

What version of Better Auth are you using?

1.4.1

System info

{
  "system": {
    "platform": "darwin",
    "arch": "arm64",
    "version": "Darwin Kernel Version 24.6.0: Mon Aug 11 21:16:33 PDT 2025; root:xnu-11417.140.69.701.11~1/RELEASE_ARM64_T8122",
    "release": "24.6.0",
    "cpuCount": 8,
    "cpuModel": "Apple M3",
    "totalMemory": "16.00 GB",
    "freeMemory": "0.84 GB"
  },
  "node": {
    "version": "v22.12.0",
    "env": "development"
  },
  "packageManager": {
    "name": "npm",
    "version": "11.6.2"
  },
  "frameworks": [
    {
      "name": "next",
      "version": "16.0.1"
    },
    {
      "name": "react",
      "version": "19.2.0"
    }
  ],
  "databases": null,
  "betterAuth": {
    "version": "1.4.1",
    "config": null
  }
}

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  emailAndPassword: {  
    enabled: true
  },
});

Additional context

No response

Originally created by @ezeparziale on GitHub (Nov 25, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/6301 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce I'm using this auth.ts in statelessMode with storeAccountCookie ```typescript import { betterAuth } from "better-auth"; import { createAuthMiddleware, customSession } from "better-auth/plugins"; export const auth = betterAuth({ plugins: [ customSession(async ({ user, session }) => { console.log("user", user); console.log("session", session); const active = true; return { user: { ...user, active, }, session, }; }), ], socialProviders: { google: { clientId: process.env.AUTH_GOOGLE_ID as string, clientSecret: process.env.AUTH_GOOGLE_SECRET as string, accessType: "offline", prompt: "select_account consent", scopes: [ "openid", "email", "profile", "https://www.googleapis.com/auth/bigquery", "https://www.googleapis.com/auth/drive", "https://www.googleapis.com/auth/devstorage.full_control", "https://www.googleapis.com/auth/devstorage.read_only", "https://www.googleapis.com/auth/devstorage.read_write", "https://www.googleapis.com/auth/cloud-platform", ].join(" "), redirectURI: "http://localhost:3000/api/auth/callback/google", }, }, session: { cookieCache: { enabled: true, maxAge: 300, strategy: "jwe", refreshCache: { updateAge: 60, }, }, }, advanced: { oauthConfig: { storeStateStrategy: "cookie", storeAccountCookie: true, }, }, hooks: { after: createAuthMiddleware(async (ctx) => {}), }, }); ``` In proxy o page when run: ```typescript const a = await auth.api.getAccessToken({ body: { providerId: "google" }, headers: await headers(), }); ```` only get some fields from Account - accessToken - accessTokenExpiresAt - scopes - IdToken But in the cookie called` better-auth.account_data` has all the data - refreshToken is missing ### Current vs. Expected behavior Expected: ```typescript export const accountSchema = coreSchema.extend({ providerId: z.string(), accountId: z.string(), userId: z.coerce.string(), accessToken: z.string().nullish(), refreshToken: z.string().nullish(), idToken: z.string().nullish(), /** * Access token expires at */ accessTokenExpiresAt: z.date().nullish(), /** * Refresh token expires at */ refreshTokenExpiresAt: z.date().nullish(), /** * The scopes that the user has authorized */ scope: z.string().nullish(), /** * Password is only stored in the credential provider */ password: z.string().nullish(), }); ``` ### What version of Better Auth are you using? 1.4.1 ### System info ```bash { "system": { "platform": "darwin", "arch": "arm64", "version": "Darwin Kernel Version 24.6.0: Mon Aug 11 21:16:33 PDT 2025; root:xnu-11417.140.69.701.11~1/RELEASE_ARM64_T8122", "release": "24.6.0", "cpuCount": 8, "cpuModel": "Apple M3", "totalMemory": "16.00 GB", "freeMemory": "0.84 GB" }, "node": { "version": "v22.12.0", "env": "development" }, "packageManager": { "name": "npm", "version": "11.6.2" }, "frameworks": [ { "name": "next", "version": "16.0.1" }, { "name": "react", "version": "19.2.0" } ], "databases": null, "betterAuth": { "version": "1.4.1", "config": null } } ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ emailAndPassword: { enabled: true }, }); ``` ### Additional context _No response_
GiteaMirror added the lockedbug labels 2026-04-15 17:53:47 -05:00
GiteaMirror commented 2026-04-15 17:53:49 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Nov 25, 2025):

It looks like the getAccessToken endpoint is only returning the core account fields defined in the default schema rather than all fields present in the stored cookie. In stateless mode with the storeAccountCookie option enabled, this behavior is intentional: the API extracts only the most common fields (accessToken, accessTokenExpiresAt, scopes, idToken) to reduce the payload and avoid exposing any sensitive or non-essential data. To work around this, you can either extend the account schema to include the extra fields you need or retrieve the full account data directly from the cookie when necessary [1].

Have you tried extending the account schema or checking if the customSession hook needs adjustment to ensure all required fields are retained in the API response?
tag @better-auth-agent if you would like an answer from the Agent

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3575494389 --> @better-auth-agent[bot] commented on GitHub (Nov 25, 2025): It looks like the getAccessToken endpoint is only returning the core account fields defined in the default schema rather than all fields present in the stored cookie. In stateless mode with the storeAccountCookie option enabled, this behavior is intentional: the API extracts only the most common fields (accessToken, accessTokenExpiresAt, scopes, idToken) to reduce the payload and avoid exposing any sensitive or non-essential data. To work around this, you can either extend the account schema to include the extra fields you need or retrieve the full account data directly from the cookie when necessary [[1]](https://github.com/better-auth/better-auth/issues/2701). Have you tried extending the account schema or checking if the customSession hook needs adjustment to ensure all required fields are retained in the API response? tag @better-auth-agent if you would like an answer from the Agent <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-04-15 17:53:50 -05:00
Author
Owner
Copy Link

@GautamBytes commented on GitHub (Nov 25, 2025):

working on it!

<!-- gh-comment-id:3575886994 --> @GautamBytes commented on GitHub (Nov 25, 2025): working on it!
GiteaMirror commented 2026-04-15 17:53:51 -05:00
Author
Owner
Copy Link

@Bekacru commented on GitHub (Nov 26, 2025):

See the AI response. But in general it's intentional that we remove the refresh token

<!-- gh-comment-id:3578123036 --> @Bekacru commented on GitHub (Nov 26, 2025): See the AI response. But in general it's intentional that we remove the refresh token
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#19108
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?