github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #5601] [MERGED] feat: stateless session management #23009

New Issue
Closed
opened 2026-04-15 21:25:10 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 21:25:10 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/5601
Author: @Bekacru
Created: 10/26/2025
Status: ✅ Merged
Merged: 10/29/2025
Merged by: @himself65

Base: canary ← Head: feat/database-less

📝 Commits (10+)

  • eefd106 feat: support databaseless session managment
  • d326473 add tests
  • 781e8e8 add versioning
  • 13d9439 chore
  • 3117c5c Apply suggestion from @Copilot
  • f4db405 Merge branch 'canary' into feat/database-less
  • 3be8dc5 Merge branch 'canary' into feat/database-less
  • 8aa9994 chore: fix lint
  • f8e2c6c Merge branch 'canary' into feat/database-less
  • dc9fb32 fix: snap

📊 Changes

10 files changed (+840 additions, -126 deletions)

View changed files

📝 docs/content/docs/concepts/session-management.mdx (+128 -2)
📝 packages/better-auth/src/__snapshots__/init.test.ts.snap (+1 -1)
📝 packages/better-auth/src/adapters/adapter-factory/index.ts (+0 -11)
📝 packages/better-auth/src/api/routes/session-api.test.ts (+417 -26)
📝 packages/better-auth/src/api/routes/session.ts (+114 -54)
📝 packages/better-auth/src/cookies/cookies.test.ts (+3 -3)
📝 packages/better-auth/src/cookies/index.ts (+103 -10)
📝 packages/better-auth/src/init.ts (+21 -7)
📝 packages/core/src/types/context.ts (+6 -1)
📝 packages/core/src/types/init-options.ts (+47 -11)

📄 Description

Summary by cubic

Adds stateless, database-less session management using signed/encrypted cookie cache with optional auto-refresh. Introduces new cookie cache strategies (compact, jwt, jwe) and a refreshCache option to refresh cookies before expiry without DB calls.

  • New Features

    • Stateless sessions: validate from cookie; no database required.
    • Cookie cache strategies: compact (default, signed), jwt (HS256), jwe (encrypted).
    • refreshCache: auto-refresh cookie before expiry (boolean or { updateAge } or custom logic). Defaults to refresh at 20% remaining.
    • More robust session decoding: supports JWE decryption and JWT verification; compact path keeps legacy base64-hmac compatible.
    • Extensive tests for JWE, stateless refresh, DB-less flow, expiry, and concurrency.

  • Migration

    • session.cookieCache.strategy: rename "base64-hmac" to "compact".
    • session.cookieCache.freshCache → session.cookieCache.refreshCache (boolean or { updateAge }).
    • Behavior change: when refreshCache is true, refresh happens statelessly (no DB). Default refresh window is 20% of maxAge.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/5601 **Author:** [@Bekacru](https://github.com/Bekacru) **Created:** 10/26/2025 **Status:** ✅ Merged **Merged:** 10/29/2025 **Merged by:** [@himself65](https://github.com/himself65) **Base:** `canary` ← **Head:** `feat/database-less` --- ### 📝 Commits (10+) - [`eefd106`](https://github.com/better-auth/better-auth/commit/eefd106c6e972cf7bb989d127256cb42499d21db) feat: support databaseless session managment - [`d326473`](https://github.com/better-auth/better-auth/commit/d3264733f20154fe779262cf484669c789296128) add tests - [`781e8e8`](https://github.com/better-auth/better-auth/commit/781e8e85e114e127b3e7ae7534a66ac460f65e81) add versioning - [`13d9439`](https://github.com/better-auth/better-auth/commit/13d94397f099efb68a5ecf9175be67d4e67b256a) chore - [`3117c5c`](https://github.com/better-auth/better-auth/commit/3117c5ca78c8b75115aa89fd4893aac792f6b373) Apply suggestion from @Copilot - [`f4db405`](https://github.com/better-auth/better-auth/commit/f4db405d6988394a7923bf1cd2742f8231dd81a4) Merge branch 'canary' into feat/database-less - [`3be8dc5`](https://github.com/better-auth/better-auth/commit/3be8dc51927270516d25d1bcd335b90313c65b73) Merge branch 'canary' into feat/database-less - [`8aa9994`](https://github.com/better-auth/better-auth/commit/8aa9994581c1b35d3cd5e7e0bd24dd0cde97672f) chore: fix lint - [`f8e2c6c`](https://github.com/better-auth/better-auth/commit/f8e2c6c29ad1328f43ca703cd7372c9a95cd0b4c) Merge branch 'canary' into feat/database-less - [`dc9fb32`](https://github.com/better-auth/better-auth/commit/dc9fb321b5cae73848885fd3fd95499e79423ed2) fix: snap ### 📊 Changes **10 files changed** (+840 additions, -126 deletions) <details> <summary>View changed files</summary> 📝 `docs/content/docs/concepts/session-management.mdx` (+128 -2) 📝 `packages/better-auth/src/__snapshots__/init.test.ts.snap` (+1 -1) 📝 `packages/better-auth/src/adapters/adapter-factory/index.ts` (+0 -11) 📝 `packages/better-auth/src/api/routes/session-api.test.ts` (+417 -26) 📝 `packages/better-auth/src/api/routes/session.ts` (+114 -54) 📝 `packages/better-auth/src/cookies/cookies.test.ts` (+3 -3) 📝 `packages/better-auth/src/cookies/index.ts` (+103 -10) 📝 `packages/better-auth/src/init.ts` (+21 -7) 📝 `packages/core/src/types/context.ts` (+6 -1) 📝 `packages/core/src/types/init-options.ts` (+47 -11) </details> ### 📄 Description <!-- This is an auto-generated description by cubic. --> ## Summary by cubic Adds stateless, database-less session management using signed/encrypted cookie cache with optional auto-refresh. Introduces new cookie cache strategies (compact, jwt, jwe) and a refreshCache option to refresh cookies before expiry without DB calls. - New Features - Stateless sessions: validate from cookie; no database required. - Cookie cache strategies: compact (default, signed), jwt (HS256), jwe (encrypted). - refreshCache: auto-refresh cookie before expiry (boolean or { updateAge } or custom logic). Defaults to refresh at 20% remaining. - More robust session decoding: supports JWE decryption and JWT verification; compact path keeps legacy base64-hmac compatible. - Extensive tests for JWE, stateless refresh, DB-less flow, expiry, and concurrency. - Migration - session.cookieCache.strategy: rename "base64-hmac" to "compact". - session.cookieCache.freshCache → session.cookieCache.refreshCache (boolean or { updateAge }). - Behavior change: when refreshCache is true, refresh happens statelessly (no DB). Default refresh window is 20% of maxAge. <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 21:25:10 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#23009
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?