github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #6940] Feature Request: Support sessionId parameter in revoke-session endpoint #19309

New Issue
Open
opened 2026-04-15 18:13:31 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-15 18:13:31 -05:00
Owner
Copy Link

Originally created by @larrykoo711 on GitHub (Dec 23, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/6940

Originally assigned to: @ping-maxwell on GitHub.

Summary

The POST /api/auth/revoke-session endpoint currently only accepts a token parameter to identify which session to revoke. However, the GET /api/auth/list-sessions endpoint returns sessions with empty token fields for security reasons (only the current session's token is accessible).

This creates a situation where session revocation is impossible through the standard API when using the sessions list.

Current Behavior

list-sessions response:

[
  {"token": "", "id": "G2XunDHmhhv2tTvMvgUt2aVLCPHafoYO", ...},
  {"token": "", "id": "m5aeFw5EXC9lokMYBgGQht7D1x3CPa8c", ...}
]
  • Token is intentionally empty for other sessions (security measure) ✅
  • Session ID is available ✅

revoke-session request:

{"token": ""}  // Empty token - revocation fails silently
  • Returns {"status": true} but does nothing
  • No sessionId parameter support ❌

Impact

  • Better-Auth UI's SessionsCard component cannot revoke sessions because it uses list-sessions data
  • Users see all their sessions but cannot revoke any of them (except current session via sign-out)
  • The revoke button shows loading indefinitely or appears to succeed but session remains

Proposed Solution

Add sessionId as an alternative parameter to the revoke-session endpoint:

// Current (token only)
body: z.object({
    token: z.string()
})

// Proposed (token OR sessionId)
body: z.object({
    token: z.string().optional(),
    sessionId: z.string().optional()
}).refine(data => data.token || data.sessionId, {
    message: "Either token or sessionId must be provided"
})

Implementation suggestion:

const revokeSession = createAuthEndpoint(
    "/revoke-session",
    {
        method: "POST",
        body: z.object({
            token: z.string().optional(),
            sessionId: z.string().optional(),
        }),
    },
    async (ctx) => {
        let session;
        
        if (ctx.body.token) {
            session = await ctx.context.internalAdapter.findSession(ctx.body.token);
        } else if (ctx.body.sessionId) {
            session = await ctx.context.internalAdapter.findSessionById(ctx.body.sessionId);
        }
        
        if (session?.session.userId === ctx.context.session.user.id) {
            await ctx.context.internalAdapter.deleteSession(session.session.token);
        }
        
        return ctx.json({ status: true });
    }
);

Environment

  • Better-Auth version: 1.4.7
  • Better-Auth UI version: 3.3.9

Related Issues

Workaround

Currently, the only workaround is to use the multiSession plugin's revokeDeviceSession which accepts sessionToken, but this only works for device sessions and requires the token which is only available for the current device's session.

Originally created by @larrykoo711 on GitHub (Dec 23, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/6940 Originally assigned to: @ping-maxwell on GitHub. ## Summary The `POST /api/auth/revoke-session` endpoint currently only accepts a `token` parameter to identify which session to revoke. However, the `GET /api/auth/list-sessions` endpoint returns sessions with **empty token fields** for security reasons (only the current session's token is accessible). This creates a situation where **session revocation is impossible** through the standard API when using the sessions list. ## Current Behavior ### `list-sessions` response: ```json [ {"token": "", "id": "G2XunDHmhhv2tTvMvgUt2aVLCPHafoYO", ...}, {"token": "", "id": "m5aeFw5EXC9lokMYBgGQht7D1x3CPa8c", ...} ] ``` - Token is intentionally empty for other sessions (security measure) ✅ - Session ID is available ✅ ### `revoke-session` request: ```json {"token": ""} // Empty token - revocation fails silently ``` - Returns `{"status": true}` but does nothing - No `sessionId` parameter support ❌ ## Impact - **Better-Auth UI's `SessionsCard` component cannot revoke sessions** because it uses `list-sessions` data - Users see all their sessions but cannot revoke any of them (except current session via sign-out) - The revoke button shows loading indefinitely or appears to succeed but session remains ## Proposed Solution Add `sessionId` as an alternative parameter to the `revoke-session` endpoint: ```typescript // Current (token only) body: z.object({ token: z.string() }) // Proposed (token OR sessionId) body: z.object({ token: z.string().optional(), sessionId: z.string().optional() }).refine(data => data.token || data.sessionId, { message: "Either token or sessionId must be provided" }) ``` ### Implementation suggestion: ```typescript const revokeSession = createAuthEndpoint( "/revoke-session", { method: "POST", body: z.object({ token: z.string().optional(), sessionId: z.string().optional(), }), }, async (ctx) => { let session; if (ctx.body.token) { session = await ctx.context.internalAdapter.findSession(ctx.body.token); } else if (ctx.body.sessionId) { session = await ctx.context.internalAdapter.findSessionById(ctx.body.sessionId); } if (session?.session.userId === ctx.context.session.user.id) { await ctx.context.internalAdapter.deleteSession(session.session.token); } return ctx.json({ status: true }); } ); ``` ## Environment - Better-Auth version: 1.4.7 - Better-Auth UI version: 3.3.9 ## Related Issues - daveyplate/better-auth-ui#39 - "Revoke session do not remove session out of database" (closed, redirected here) ## Workaround Currently, the only workaround is to use the `multiSession` plugin's `revokeDeviceSession` which accepts `sessionToken`, but this only works for device sessions and requires the token which is only available for the current device's session.
GiteaMirror added the coreenhancement labels 2026-04-15 18:13:32 -05:00
GiteaMirror commented 2026-04-15 18:13:34 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Dec 23, 2025):

Thank you for your feature request regarding the sessionId parameter in the revoke-session endpoint! It seems you've identified a significant limitation where the current setup makes it challenging to revoke sessions for which tokens are not available.

Your suggestion to support sessionId as an alternative parameter for revoking sessions is well noted. This enhancement would indeed improve the usability of the SessionsCard component and resolve the issue where users are unable to revoke their sessions.

While I can't provide steps on the implementation, your proposed solution looks sound and aligns with addressing the problem effectively. There are some related discussions about session management and revocation strategies, indicating that this is an area of active interest within the community [1], [2].

If you haven’t already, you might want to tag relevant members of the Better Auth team, Beka (@bekacru) and Max (@ping__), for direct feedback or to see if they have similar enhancement proposals in the pipeline.

In the meantime, do you have any particular use cases or scenarios you'd like to tackle with this feature?

If you need more help, tag @better-auth-agent in a comment so I can respond.

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3685008799 --> @better-auth-agent[bot] commented on GitHub (Dec 23, 2025): Thank you for your feature request regarding the `sessionId` parameter in the `revoke-session` endpoint! It seems you've identified a significant limitation where the current setup makes it challenging to revoke sessions for which tokens are not available. Your suggestion to support `sessionId` as an alternative parameter for revoking sessions is well noted. This enhancement would indeed improve the usability of the `SessionsCard` component and resolve the issue where users are unable to revoke their sessions. While I can't provide steps on the implementation, your proposed solution looks sound and aligns with addressing the problem effectively. There are some related discussions about session management and revocation strategies, indicating that this is an area of active interest within the community [[1]](https://github.com/better-auth/better-auth/issues/6224), [[2]](https://github.com/better-auth/better-auth/issues/1780). If you haven’t already, you might want to tag relevant members of the Better Auth team, Beka (@bekacru) and Max (@ping__), for direct feedback or to see if they have similar enhancement proposals in the pipeline. In the meantime, do you have any particular use cases or scenarios you'd like to tackle with this feature? _If you need more help, tag @better-auth-agent in a comment so I can respond._ <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) • [Discord](https://discord.gg/fG2XXEuQX3) • [GitHub](https://github.com/Skyvern-AI/Skyvern) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/fG2XXEuQX3) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/Skyvern-AI/Skyvern)
GiteaMirror commented 2026-04-15 18:13:34 -05:00
Author
Owner
Copy Link

@R-udren commented on GitHub (Jan 10, 2026):

+1, missed when a list-sessions stopped returning tokens.

<!-- gh-comment-id:3733630633 --> @R-udren commented on GitHub (Jan 10, 2026): +1, missed when a list-sessions stopped returning tokens.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label core enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#19309
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?