github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

Oauth flows no longer work with a proxy on a different domain for previews (since v1.3.19) #2049

New Issue
Closed
opened 2026-03-13 09:23:06 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-03-13 09:23:06 -05:00
Owner
Copy Link

Originally created by @jakst on GitHub (Sep 30, 2025).

In v1.3.19, this change was introduced: 8b617112b8

We have preview environments on different domains, and then an oAuthProxy on a stable domain for the oauth callbacks.

With the change to cookies, better-auth is now trying to read cookies on the proxy domain that were set on the preview domain, which of course aren't there. This leads to the following error:

Image
Originally created by @jakst on GitHub (Sep 30, 2025). In v1.3.19, this change was introduced: https://github.com/better-auth/better-auth/commit/8b617112b8ff0ece6752cd55bc6a2664234c8c21 We have preview environments on different domains, and then an oAuthProxy on a stable domain for the oauth callbacks. With the change to cookies, better-auth is now trying to read cookies on the proxy domain that were set on the preview domain, which of course aren't there. This leads to the following error: <img width="628" height="570" alt="Image" src="https://github.com/user-attachments/assets/6aa61344-3a38-458e-97b8-6c88a95e326d" />
GiteaMirror commented 2026-03-13 09:23:07 -05:00
Author
Owner
Copy Link

@jakst commented on GitHub (Sep 30, 2025):

I guess #4953 is for the same issue

@jakst commented on GitHub (Sep 30, 2025): I guess #4953 is for the same issue
GiteaMirror commented 2026-03-13 09:23:08 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Sep 30, 2025):

Yes, issue #4953 is about the same cross-domain OAuth problem. It describes how the oAuthProxy plugin fails in non-production environments (like localhost or Vercel previews), causing state mismatch errors because Better Auth can't persist or verify the OAuth state across domains during the callback. The root cause is that cookies set on one domain (preview) aren't accessible on the proxy domain, breaking the flow and leading to errors like "State Mismatch. Verification not found" see #4953.

The recommended fixes are to upgrade to the latest better-auth version, make sure all preview/local URLs are listed in trustedOrigins, register all relevant callback URLs with your OAuth providers, and set the productionURL option correctly in oAuthProxy. Also, ensure preview/local environments share the same database for verification state, and that cookies are set and passed correctly across redirects see #4953.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Sep 30, 2025): <!-- Answer --> Yes, issue #4953 is about the same cross-domain OAuth problem. It describes how the oAuthProxy plugin fails in non-production environments (like localhost or Vercel previews), causing state mismatch errors because Better Auth can't persist or verify the OAuth state across domains during the callback. The root cause is that cookies set on one domain (preview) aren't accessible on the proxy domain, breaking the flow and leading to errors like "State Mismatch. Verification not found" [see #4953](https://github.com/better-auth/better-auth/issues/4953). The recommended fixes are to upgrade to the latest better-auth version, make sure all preview/local URLs are listed in `trustedOrigins`, register all relevant callback URLs with your OAuth providers, and set the `productionURL` option correctly in oAuthProxy. Also, ensure preview/local environments share the same database for verification state, and that cookies are set and passed correctly across redirects [see #4953](https://github.com/better-auth/better-auth/issues/4953). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/0eb13c44-18a6-4a64-bef3-949b51785945?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/0eb13c44-18a6-4a64-bef3-949b51785945?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/0eb13c44-18a6-4a64-bef3-949b51785945?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/0eb13c44-18a6-4a64-bef3-949b51785945?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/0eb13c44-18a6-4a64-bef3-949b51785945?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/0eb13c44-18a6-4a64-bef3-949b51785945?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/0eb13c44-18a6-4a64-bef3-949b51785945?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/4985)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#2049
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?