github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #6359] feat: implement cross-subdomain cookies plugin and fix TODOs #23515

New Issue
Open
opened 2026-04-15 21:47:04 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 21:47:04 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/6359
Author: @CodewithEvilxd
Created: 11/27/2025
Status: 🔄 Open

Base: main ← Head: canary

📝 Commits (4)

  • 65d7af9 feat: implement cross-subdomain cookies plugin and fix TODOs
  • 865aa36 fix: address security and type issues in cross-subdomain plugin
  • 5a6b931 style: fix linting issues
  • fb01ab2 fix: restore bun types in tsconfig

📊 Changes

11 files changed (+121 additions, -33 deletions)

View changed files

📝 demo/nextjs/package.json (+3 -1)
📝 demo/stateless/package.json (+3 -1)
📝 docs/content/docs/plugins/2fa.mdx (+0 -1)
📝 docs/package.json (+3 -1)
📝 packages/better-auth/package.json (+2 -0)
📝 packages/better-auth/src/context/helpers.ts (+2 -1)
➕ packages/better-auth/src/plugins/cross-subdomain.ts (+67 -0)
📝 packages/better-auth/src/plugins/jwt/jwt.test.ts (+28 -20)
📝 packages/better-auth/src/social.test.ts (+1 -2)
📝 pnpm-lock.yaml (+11 -5)
📝 tsconfig.base.json (+1 -1)

📄 Description

Summary

This pull request adds a new cross-subdomain cookies plugin and includes several code quality improvements to the Better Auth library.

Changes Made

New Features

Cross-Subdomain Cookies Plugin

  • Implemented a new internal plugin for handling cross-subdomain cookie authentication
  • Added automatic CORS header management for secure cookie sharing across subdomains
  • Created middleware that validates requests from subdomains and sets appropriate CORS headers
  • Included proper error handling for invalid URLs and edge cases

Bug Fixes and Improvements

JWT Test Optimization

  • Removed unnecessary API call in the JWKS test that was forcing JWK generation
  • The getJwks endpoint already handles JWK creation automatically, making the extra call redundant
  • Improved test performance by eliminating unnecessary operations

Type Safety Enhancements

  • Fixed type casting issues in social provider tests by removing 'as any' usage
  • Added proper type annotations to callback functions in JWT tests
  • Improved overall TypeScript compliance and code reliability

Documentation Corrections

  • Fixed incorrect parameter in 2FA plugin documentation
  • Removed non-existent callbackURL parameter from verifyTotp method example
  • Ensured documentation accurately reflects the actual API

Technical Details

Files Modified:

  • packages/better-auth/src/plugins/cross-subdomain.ts (new file)
  • packages/better-auth/src/context/helpers.ts
  • packages/better-auth/src/plugins/jwt/jwt.test.ts
  • packages/better-auth/src/social.test.ts
  • docs/content/docs/plugins/2fa.mdx

Testing:

  • All existing tests pass (1192 tests)
  • No breaking changes introduced
  • Maintains backward compatibility
  • Follows existing code patterns and conventions

Benefits

  • Enhanced security through cross-subdomain cookie support
  • Better developer experience with accurate documentation
  • Improved performance in test suite
  • Higher code quality with better type safety

Summary by cubic

Adds cross-subdomain cookie support with an internal plugin that sets safe CORS headers for subdomain requests. Also cleans up tests and types, and fixes 2FA docs to match the API.

  • New Features

    • Added cross-subdomain cookies plugin to share auth cookies across subdomains.
    • Middleware validates subdomain requests and applies CORS headers.
    • Graceful handling of invalid Origin/Referer URLs.

  • Bug Fixes

    • Removed redundant token call in JWKS test; the JWKS endpoint generates keys automatically.
    • Improved type safety in JWT and social provider tests; no more as any.
    • Corrected 2FA docs by removing the non-existent callbackURL from verifyTotp.
    • Updated TS config and dev types to align with Node usage.

Written for commit fb01ab2c24. Summary will update automatically on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/6359 **Author:** [@CodewithEvilxd](https://github.com/CodewithEvilxd) **Created:** 11/27/2025 **Status:** 🔄 Open **Base:** `main` ← **Head:** `canary` --- ### 📝 Commits (4) - [`65d7af9`](https://github.com/better-auth/better-auth/commit/65d7af99ffa5e64ddfb730571f3391e219824a1a) feat: implement cross-subdomain cookies plugin and fix TODOs - [`865aa36`](https://github.com/better-auth/better-auth/commit/865aa36aac6de9413e1672fe552296b8547bf6dd) fix: address security and type issues in cross-subdomain plugin - [`5a6b931`](https://github.com/better-auth/better-auth/commit/5a6b9316120a1144cb418d1dc82b48ff3ea890b8) style: fix linting issues - [`fb01ab2`](https://github.com/better-auth/better-auth/commit/fb01ab2c246993012f44661aa47d94731c30348e) fix: restore bun types in tsconfig ### 📊 Changes **11 files changed** (+121 additions, -33 deletions) <details> <summary>View changed files</summary> 📝 `demo/nextjs/package.json` (+3 -1) 📝 `demo/stateless/package.json` (+3 -1) 📝 `docs/content/docs/plugins/2fa.mdx` (+0 -1) 📝 `docs/package.json` (+3 -1) 📝 `packages/better-auth/package.json` (+2 -0) 📝 `packages/better-auth/src/context/helpers.ts` (+2 -1) ➕ `packages/better-auth/src/plugins/cross-subdomain.ts` (+67 -0) 📝 `packages/better-auth/src/plugins/jwt/jwt.test.ts` (+28 -20) 📝 `packages/better-auth/src/social.test.ts` (+1 -2) 📝 `pnpm-lock.yaml` (+11 -5) 📝 `tsconfig.base.json` (+1 -1) </details> ### 📄 Description ## Summary This pull request adds a new cross-subdomain cookies plugin and includes several code quality improvements to the Better Auth library. ## Changes Made ### New Features **Cross-Subdomain Cookies Plugin** - Implemented a new internal plugin for handling cross-subdomain cookie authentication - Added automatic CORS header management for secure cookie sharing across subdomains - Created middleware that validates requests from subdomains and sets appropriate CORS headers - Included proper error handling for invalid URLs and edge cases ### Bug Fixes and Improvements **JWT Test Optimization** - Removed unnecessary API call in the JWKS test that was forcing JWK generation - The getJwks endpoint already handles JWK creation automatically, making the extra call redundant - Improved test performance by eliminating unnecessary operations **Type Safety Enhancements** - Fixed type casting issues in social provider tests by removing 'as any' usage - Added proper type annotations to callback functions in JWT tests - Improved overall TypeScript compliance and code reliability **Documentation Corrections** - Fixed incorrect parameter in 2FA plugin documentation - Removed non-existent callbackURL parameter from verifyTotp method example - Ensured documentation accurately reflects the actual API ## Technical Details **Files Modified:** - packages/better-auth/src/plugins/cross-subdomain.ts (new file) - packages/better-auth/src/context/helpers.ts - packages/better-auth/src/plugins/jwt/jwt.test.ts - packages/better-auth/src/social.test.ts - docs/content/docs/plugins/2fa.mdx **Testing:** - All existing tests pass (1192 tests) - No breaking changes introduced - Maintains backward compatibility - Follows existing code patterns and conventions ## Benefits - Enhanced security through cross-subdomain cookie support - Better developer experience with accurate documentation - Improved performance in test suite - Higher code quality with better type safety <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Adds cross-subdomain cookie support with an internal plugin that sets safe CORS headers for subdomain requests. Also cleans up tests and types, and fixes 2FA docs to match the API. - New Features - Added cross-subdomain cookies plugin to share auth cookies across subdomains. - Middleware validates subdomain requests and applies CORS headers. - Graceful handling of invalid Origin/Referer URLs. - Bug Fixes - Removed redundant token call in JWKS test; the JWKS endpoint generates keys automatically. - Improved type safety in JWT and social provider tests; no more `as any`. - Corrected 2FA docs by removing the non-existent `callbackURL` from `verifyTotp`. - Updated TS config and dev types to align with Node usage. <sup>Written for commit fb01ab2c246993012f44661aa47d94731c30348e. Summary will update automatically on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 21:47:04 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#23515
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?