github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 06:16:18 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #9087] [MERGED] fix(client): trigger $sessionSignal for session-rotating endpoints #25329

New Issue
Closed
opened 2026-04-15 22:50:18 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 22:50:18 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/9087
Author: @ramonclaudio
Created: 4/10/2026
Status: ✅ Merged
Merged: 4/15/2026
Merged by: @ping-maxwell

Base: main ← Head: fix/client-matcher-rotation-paths

📝 Commits (4)

  • 7a5b5df fix(client): trigger $sessionSignal for session-rotating endpoints
  • 83bef07 chore(changeset): add changeset for client matcher rotation paths fix
  • f8ca3d2 test(client): cover session-rotating endpoints in atomListeners matcher
  • 0abdc46 Merge branch 'main' into fix/client-matcher-rotation-paths

📊 Changes

3 files changed (+78 additions, -1 deletions)

View changed files

➕ .changeset/fix-client-matcher-rotation-paths.md (+5 -0)
📝 packages/better-auth/src/client/config.ts (+3 -1)
📝 packages/better-auth/src/client/proxy.test.ts (+70 -0)

📄 Description

Adds /change-password and /revoke-other-sessions to the default atomListeners matcher in packages/better-auth/src/client/config.ts. /change-password rotates the caller's session via setSessionCookie (when revokeOtherSessions: true) but wasn't in the matcher, so $sessionSignal never flipped on success and useSession() returned the stale session until the next focus, poll, or broadcast event. /revoke-other-sessions doesn't rotate the caller's session but is included for consistency with /revoke-sessions and /revoke-session, and to keep listSessions UIs fresh. Same family as #858 (passkey, fixed in #5096) and #1286 (email-otp, fixed in #5219).

  path === "/revoke-session" ||
- path === "/change-email";
+ path === "/revoke-other-sessions" ||
+ path === "/change-email" ||
+ path === "/change-password";

JWT-backed integrations feel this the most. The cached JWT carries the old sessionId claim, the auth layer accepts the still-valid signature, every application-layer session lookup throws.

Reproduced on a real app: before, every query after changePassword({ revokeOtherSessions: true }) failed with an auth error until reload. After, the session refetches on the next tick and queries pick up the new identity.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/9087 **Author:** [@ramonclaudio](https://github.com/ramonclaudio) **Created:** 4/10/2026 **Status:** ✅ Merged **Merged:** 4/15/2026 **Merged by:** [@ping-maxwell](https://github.com/ping-maxwell) **Base:** `main` ← **Head:** `fix/client-matcher-rotation-paths` --- ### 📝 Commits (4) - [`7a5b5df`](https://github.com/better-auth/better-auth/commit/7a5b5df3ebb523886e6e9d9e71a1123965f792c2) fix(client): trigger $sessionSignal for session-rotating endpoints - [`83bef07`](https://github.com/better-auth/better-auth/commit/83bef07483588ed3e1ac8820a84a67388cc2fe79) chore(changeset): add changeset for client matcher rotation paths fix - [`f8ca3d2`](https://github.com/better-auth/better-auth/commit/f8ca3d26d0e9b4d1ccf9f9607186c6298621582b) test(client): cover session-rotating endpoints in atomListeners matcher - [`0abdc46`](https://github.com/better-auth/better-auth/commit/0abdc466cbf607d7bdba4d4071aedcc86468bd61) Merge branch 'main' into fix/client-matcher-rotation-paths ### 📊 Changes **3 files changed** (+78 additions, -1 deletions) <details> <summary>View changed files</summary> ➕ `.changeset/fix-client-matcher-rotation-paths.md` (+5 -0) 📝 `packages/better-auth/src/client/config.ts` (+3 -1) 📝 `packages/better-auth/src/client/proxy.test.ts` (+70 -0) </details> ### 📄 Description Adds `/change-password` and `/revoke-other-sessions` to the default `atomListeners` matcher in `packages/better-auth/src/client/config.ts`. `/change-password` rotates the caller's session via `setSessionCookie` (when `revokeOtherSessions: true`) but wasn't in the matcher, so `$sessionSignal` never flipped on success and `useSession()` returned the stale session until the next focus, poll, or broadcast event. `/revoke-other-sessions` doesn't rotate the caller's session but is included for consistency with `/revoke-sessions` and `/revoke-session`, and to keep `listSessions` UIs fresh. Same family as #858 (passkey, fixed in #5096) and #1286 (email-otp, fixed in #5219). ```diff path === "/revoke-session" || - path === "/change-email"; + path === "/revoke-other-sessions" || + path === "/change-email" || + path === "/change-password"; ``` JWT-backed integrations feel this the most. The cached JWT carries the old `sessionId` claim, the auth layer accepts the still-valid signature, every application-layer session lookup throws. Reproduced on a real app: before, every query after `changePassword({ revokeOtherSessions: true })` failed with an auth error until reload. After, the session refetches on the next tick and queries pick up the new identity. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 22:50:18 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#25329
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?