github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-27 17:36:42 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #8099] wrong error code when invalid refresh token is given #19625

New Issue
Closed
opened 2026-04-15 18:54:14 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-15 18:54:14 -05:00
Owner
Copy Link

Originally created by @omer9564 on GitHub (Feb 22, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/8099

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

  1. Create a flow of oauth with genericOAuth plugin
  2. remove the refresh token from the DB
  3. wait for the token to be expired ( or set the expiry to be short in the beginning )
  4. /api/auth/oauth2/token will now return the following 400 response which doesn't trigger clients to reauthenticate
{
  "error_description":"session not found",
  "error":"invalid_request"
}

Current vs. Expected behavior

According to OAuth Spec the invalid_grant suits better and triggers clients to attempt a clean new OAuth authentication flow.

What version of Better Auth are you using?

^1.4.18

System info

{
  "system": {
    "platform": "darwin",
    "arch": "arm64",
    "version": "Darwin Kernel Version 24.6.0: Wed Oct 15 21:12:08 PDT 2025; root:xnu-11417.140.69.703.14~1/RELEASE_ARM64_T6020",
    "release": "24.6.0",
    "cpuCount": 10,
    "cpuModel": "Apple M2 Pro",
    "totalMemory": "32.00 GB",
    "freeMemory": "0.36 GB"
  },
  "node": {
    "version": "v22.18.0",
    "env": "development"
  },
  "packageManager": {
    "name": "npm",
    "version": "10.9.3"
  },
  "frameworks": null,
  "databases": null,
  "betterAuth": {
    "version": "Unknown",
    "config": null
  }
}

Which area(s) are affected? (Select all that apply)

Client, Backend

Auth config (if applicable)

Additional context

The code is present here

Originally created by @omer9564 on GitHub (Feb 22, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/8099 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce 1. Create a flow of oauth with genericOAuth plugin 2. remove the refresh token from the DB 3. wait for the token to be expired ( or set the expiry to be short in the beginning ) 4. /api/auth/oauth2/token will now return the following 400 response which doesn't trigger clients to reauthenticate ```json { "error_description":"session not found", "error":"invalid_request" } ``` ### Current vs. Expected behavior According to OAuth Spec the [invalid_grant](https://datatracker.ietf.org/doc/html/rfc6749#:~:text=by%20the%20client.-,invalid_grant,-The%20provided%20authorization) suits better and triggers clients to attempt a clean new OAuth authentication flow. ### What version of Better Auth are you using? ^1.4.18 ### System info ```bash { "system": { "platform": "darwin", "arch": "arm64", "version": "Darwin Kernel Version 24.6.0: Wed Oct 15 21:12:08 PDT 2025; root:xnu-11417.140.69.703.14~1/RELEASE_ARM64_T6020", "release": "24.6.0", "cpuCount": 10, "cpuModel": "Apple M2 Pro", "totalMemory": "32.00 GB", "freeMemory": "0.36 GB" }, "node": { "version": "v22.18.0", "env": "development" }, "packageManager": { "name": "npm", "version": "10.9.3" }, "frameworks": null, "databases": null, "betterAuth": { "version": "Unknown", "config": null } } ``` ### Which area(s) are affected? (Select all that apply) Client, Backend ### Auth config (if applicable) ```typescript ``` ### Additional context The code is present [here](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/src/token.ts#L932-L969)
GiteaMirror added the lockedbug labels 2026-04-15 18:54:14 -05:00
GiteaMirror commented 2026-04-15 18:54:16 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Feb 22, 2026):

Hi @omer9564! I'm Dosu and I’m helping the better-auth team.

You're correct that this doesn't comply with RFC 6749. Looking at the code in token.ts lines 932-969, the issue is in two places:

  1. Lines 944-948 - When a refresh token is expired (expiresAt < now), it returns invalid_request
  2. Lines 951-968 - When a refresh token is revoked, it also returns invalid_request

Both cases should return invalid_grant per the OAuth spec to properly trigger client reauthentication.

This appears to be part of a broader pattern of RFC 6749 compliance issues in the OAuth provider implementation (see #6651 for another example).

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

<!-- gh-comment-id:3941346908 --> @dosubot[bot] commented on GitHub (Feb 22, 2026): <!-- Greeting --> Hi @omer9564! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the better-auth team. <!-- Answer --> You're correct that this doesn't comply with RFC 6749. Looking at the code in [token.ts lines 932-969](https://github.com/better-auth/better-auth/blob/9c78e5cb18945077e03697c42a7c35037ab81a86/packages/oauth-provider/src/token.ts#L932-L969), the issue is in two places: 1. **Lines 944-948** - When a refresh token is expired (`expiresAt < now`), it returns `invalid_request` 2. **Lines 951-968** - When a refresh token is revoked, it also returns `invalid_request` Both cases should return `invalid_grant` per the OAuth spec to properly trigger client reauthentication. This appears to be part of a broader pattern of RFC 6749 compliance issues in the OAuth provider implementation (see [#6651](https://github.com/better-auth/better-auth/issues/6651) for another example). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/04b683db-7459-4db7-82d6-546ce5b77fa6?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/04b683db-7459-4db7-82d6-546ce5b77fa6?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/04b683db-7459-4db7-82d6-546ce5b77fa6?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/04b683db-7459-4db7-82d6-546ce5b77fa6?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/04b683db-7459-4db7-82d6-546ce5b77fa6?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/04b683db-7459-4db7-82d6-546ce5b77fa6?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/04b683db-7459-4db7-82d6-546ce5b77fa6?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=You%27re%20correct%20that%20this%20doesn%27t%20comply%20with%20RFC%206749.%20Looking%20at%20the%20code%20in%20%5Btoken.ts%20lines%20932-969%5D%28https%3A//github.com/better-auth/better-auth/blob/9c78e5cb18945077e03697c42a7c35037ab81a86/packages/oauth-provider/src/token.ts%23L932-L969%29%2C%20the%20issue%20is%20in%20two%20places%3A%0A%0A1.%20%2A%2ALines%20944-948%2A%2A%20-%20When%20a%20refresh%20token%20is%20expired%20%28%60expiresAt%20%3C%20now%60%29%2C%20it%20returns%20%60invalid_request%60%0A2.%20%2A%2ALines%20951-968%2A%2A%20-%20When%20a%20refresh%20token%20is%20revoked%2C%20it%20also%20returns%20%60invalid_request%60%0A%0ABoth%20cases%20should%20return%20%60invalid_grant%60%20per%20the%20OAuth%20spec%20to%20properly%20trigger%20client%20reauthentication.%0A%0AThis%20appears%20to%20be%20part%20of%20a%20broader%20pattern%20of%20RFC%206749%20compliance%20issues%20in%20the%20OAuth%20provider%20implementation%20%28see%20%5B%236651%5D%28https%3A//github.com/better-auth/better-auth/issues/6651%29%20for%20another%20example%29.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/8099)
GiteaMirror commented 2026-04-15 18:54:16 -05:00
Author
Owner
Copy Link

@luchersou commented on GitHub (Feb 23, 2026):

I've opened a PR to fix this: #8103

Fixed the three cases where invalid_request was being returned
instead of invalid_grant (token not found, expired, and revoked),
as all three represent an invalid grant per RFC 6749.

<!-- gh-comment-id:3942021771 --> @luchersou commented on GitHub (Feb 23, 2026): I've opened a PR to fix this: #8103 Fixed the three cases where `invalid_request` was being returned instead of `invalid_grant` (token not found, expired, and revoked), as all three represent an invalid grant per RFC 6749.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#19625
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?