github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 16:11:53 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #9108] tanstack start + session cookieCache + Safari report error: SyntaxError: The string did not match the expected pattern #19908

New Issue
Closed
opened 2026-04-15 19:16:29 -05:00 by GiteaMirror · 7 comments
GiteaMirror commented 2026-04-15 19:16:29 -05:00
Owner
Copy Link

Originally created by @chshouyu on GitHub (Apr 10, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/9108

Originally assigned to: @bytaesu on GitHub.

Is this suited for github?

  • Yes, this is suited for github

Reproduction

source code: https://github.com/chshouyu/tanstack-cf-better-auth
online demo: https://tanstack-cf-better-auth.qing-yang.workers.dev

reproduction steps:

  1. in the demo, sign up and sign in.
  2. wait a few minutes.
  3. click the Go to home link

safari will report error: SyntaxError: The string did not match the expected pattern.

Current vs. Expected behavior

Image

What version of Better Auth are you using?

1.6.2

System info

{
  "system": {
    "platform": "darwin",
    "arch": "arm64",
    "version": "Darwin Kernel Version 25.4.0: Thu Mar 19 19:33:25 PDT 2026; root:xnu-12377.101.15~1/RELEASE_ARM64_T6041",
    "release": "25.4.0",
    "cpuCount": 16,
    "cpuModel": "Apple M4 Max",
    "totalMemory": "48.00 GB",
    "freeMemory": "1.67 GB"
  },
  "node": {
    "version": "v24.14.1",
    "env": "development"
  },
  "packageManager": {
    "name": "npm",
    "version": "11.12.0"
  },
  "frameworks": [
    {
      "name": "react",
      "version": "^19.2.5"
    }
  ],
  "databases": null,
  "betterAuth": {
    "version": "^1.6.2",
    "config": null
  }
}

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

import { betterAuth } from 'better-auth'
import { tanstackStartCookies } from 'better-auth/tanstack-start'
import { env } from 'cloudflare:workers'

export const auth = betterAuth({
  emailAndPassword: {
    enabled: true,
  },
  database: env.MY_DB,
  plugins: [tanstackStartCookies()],
  session: {
    cookieCache: {
      enabled: true,
      maxAge: 30, // Cache duration in seconds
    },
  },
})

Additional context

OS: macOS 26.4
Safari: 26.4

  1. it's only reproducible with Safari + enable session cookieCache
  2. disable session cookieCache on Safari can fix this
  3. enable session cookieCache with Chrome or Firefox have no problem
Originally created by @chshouyu on GitHub (Apr 10, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/9108 Originally assigned to: @bytaesu on GitHub. ### Is this suited for github? - [x] Yes, this is suited for github ### Reproduction source code: https://github.com/chshouyu/tanstack-cf-better-auth online demo: https://tanstack-cf-better-auth.qing-yang.workers.dev reproduction steps: 1. in the demo, sign up and sign in. 2. wait a few minutes. 3. click the `Go to home` link safari will report error: `SyntaxError: The string did not match the expected pattern.` ### Current vs. Expected behavior ![Image](https://github.com/user-attachments/assets/0b227d9c-eb4b-4690-b735-f627ccd3f310) ### What version of Better Auth are you using? 1.6.2 ### System info ```bash { "system": { "platform": "darwin", "arch": "arm64", "version": "Darwin Kernel Version 25.4.0: Thu Mar 19 19:33:25 PDT 2026; root:xnu-12377.101.15~1/RELEASE_ARM64_T6041", "release": "25.4.0", "cpuCount": 16, "cpuModel": "Apple M4 Max", "totalMemory": "48.00 GB", "freeMemory": "1.67 GB" }, "node": { "version": "v24.14.1", "env": "development" }, "packageManager": { "name": "npm", "version": "11.12.0" }, "frameworks": [ { "name": "react", "version": "^19.2.5" } ], "databases": null, "betterAuth": { "version": "^1.6.2", "config": null } } ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript import { betterAuth } from 'better-auth' import { tanstackStartCookies } from 'better-auth/tanstack-start' import { env } from 'cloudflare:workers' export const auth = betterAuth({ emailAndPassword: { enabled: true, }, database: env.MY_DB, plugins: [tanstackStartCookies()], session: { cookieCache: { enabled: true, maxAge: 30, // Cache duration in seconds }, }, }) ``` ### Additional context OS: macOS 26.4 Safari: 26.4 1. it's only reproducible with Safari + enable session cookieCache 2. disable session cookieCache on Safari can fix this 3. enable session cookieCache with Chrome or Firefox have no problem
GiteaMirror added the coreneeds: info labels 2026-04-15 19:16:29 -05:00
GiteaMirror commented 2026-04-15 19:16:33 -05:00
Author
Owner
Copy Link

@bytaesu commented on GitHub (Apr 11, 2026):

Let me check 🧐

<!-- gh-comment-id:4228007900 --> @bytaesu commented on GitHub (Apr 11, 2026): Let me check 🧐
GiteaMirror commented 2026-04-15 19:16:34 -05:00
Author
Owner
Copy Link

@bytaesu commented on GitHub (Apr 11, 2026):

Hi @chshouyu,

I can't seem to reproduce this on my Safari. Could it be a browser issue? 🤔

https://github.com/user-attachments/assets/611e167d-7c42-4d7f-bb8a-7fa72fae4844

<!-- gh-comment-id:4228026452 --> @bytaesu commented on GitHub (Apr 11, 2026): Hi @chshouyu, I can't seem to reproduce this on my Safari. Could it be a browser issue? 🤔 https://github.com/user-attachments/assets/611e167d-7c42-4d7f-bb8a-7fa72fae4844
GiteaMirror commented 2026-04-15 19:16:35 -05:00
Author
Owner
Copy Link

@chshouyu commented on GitHub (Apr 11, 2026):

https://github.com/user-attachments/assets/99045266-040b-4534-bd10-2c02695e4b82

Hi @bytaesu , my apologies—this issue can indeed be difficult to reproduce at times. However, it is absolutely 100% reproducible; as I mentioned previously, you just need to "wait a few minutes." Specifically, you need to wait about 10 minutes after signing in. I'm not sure if this is related to Cloudflare's "cold start" behavior.

I had the AI ​​analyze the code, and here is how it explained it:

Why this likely happens
1. cookieCache is enabled with a short TTL (maxAge: 60), so the cached session cookie (session_data) expires quickly.
2. After idle time, the next session fetch path rewrites cookie cache and emits Set-Cookie.
3. In my stack, that Set-Cookie appears to flow into the client server-function header merge path.
4. Safari is stricter than Chrome/Firefox when constructing Headers(...), so it throws on this malformed/forbidden header state.

Additional notes

  • The issue is easier to reproduce on the first request after idle.
  • During frequent interaction, it often does not reproduce (likely due to cache-valid window and different write timing).
  • Disabling cookie cache is a reliable workaround in my environment.
<!-- gh-comment-id:4229209097 --> @chshouyu commented on GitHub (Apr 11, 2026): https://github.com/user-attachments/assets/99045266-040b-4534-bd10-2c02695e4b82 Hi @bytaesu , my apologies—this issue can indeed be difficult to reproduce at times. However, it is absolutely 100% reproducible; as I mentioned previously, you just need to "wait a few minutes." Specifically, you need to wait about 10 minutes after signing in. I'm not sure if this is related to Cloudflare's "cold start" behavior. I had the AI ​​analyze the code, and here is how it explained it: ``` Why this likely happens 1. cookieCache is enabled with a short TTL (maxAge: 60), so the cached session cookie (session_data) expires quickly. 2. After idle time, the next session fetch path rewrites cookie cache and emits Set-Cookie. 3. In my stack, that Set-Cookie appears to flow into the client server-function header merge path. 4. Safari is stricter than Chrome/Firefox when constructing Headers(...), so it throws on this malformed/forbidden header state. ``` Additional notes - The issue is easier to reproduce on the first request after idle. - During frequent interaction, it often does not reproduce (likely due to cache-valid window and different write timing). - Disabling cookie cache is a reliable workaround in my environment.
GiteaMirror commented 2026-04-15 19:16:36 -05:00
Author
Owner
Copy Link

@chshouyu commented on GitHub (Apr 11, 2026):

I can try deploying it elsewhere—specifically, not on Cloudflare. Please wait for my update.

<!-- gh-comment-id:4229245564 --> @chshouyu commented on GitHub (Apr 11, 2026): I can try deploying it elsewhere—specifically, not on Cloudflare. Please wait for my update.
GiteaMirror commented 2026-04-15 19:16:37 -05:00
Author
Owner
Copy Link

@chshouyu commented on GitHub (Apr 11, 2026):

Image

export const getSessionFn = createServerFn({ method: 'GET' }).handler(async () => {
  const headers = getRequestHeaders()

  const session = await auth.api.getSession({ headers })

  return session
})

I think it has become clear that an error occurred internally when executing this code—specifically, auth.api.getSession failed to correctly parse the return value. However, I am unclear why this is related to Safari.

<!-- gh-comment-id:4229607991 --> @chshouyu commented on GitHub (Apr 11, 2026): ![Image](https://github.com/user-attachments/assets/014d6095-4852-46d9-9464-ed43a987321c) ```ts export const getSessionFn = createServerFn({ method: 'GET' }).handler(async () => { const headers = getRequestHeaders() const session = await auth.api.getSession({ headers }) return session }) ``` I think it has become clear that an error occurred internally when executing this code—specifically, `auth.api.getSession` failed to correctly parse the return value. However, I am unclear why this is related to Safari.
GiteaMirror commented 2026-04-15 19:16:38 -05:00
Author
Owner
Copy Link

@chshouyu commented on GitHub (Apr 11, 2026):

I've decided to close this issue for now because I'm really unsure whether it's a Tanstack start issue, a better-auth issue, or a Cloudflare issue. I'll keep the GitHub repository and online demo open in case anyone encounters a similar problem or wants to investigate further.

<!-- gh-comment-id:4229747687 --> @chshouyu commented on GitHub (Apr 11, 2026): I've decided to close this issue for now because I'm really unsure whether it's a Tanstack start issue, a better-auth issue, or a Cloudflare issue. I'll keep the GitHub repository and online demo open in case anyone encounters a similar problem or wants to investigate further.
GiteaMirror commented 2026-04-15 19:16:39 -05:00
Author
Owner
Copy Link

@bytaesu commented on GitHub (Apr 12, 2026):

@chshouyu Thanks for looking into this!
If the issue persists, feel free to open a new issue. I'll take a look right away 😁

<!-- gh-comment-id:4230673503 --> @bytaesu commented on GitHub (Apr 12, 2026): @chshouyu Thanks for looking into this! If the issue persists, feel free to open a new issue. I'll take a look right away 😁
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label core needs: info
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#19908
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?