github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #9211] fix(api): preserve response headers when APIError is thrown #25407

New Issue
Open
opened 2026-04-15 22:52:22 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 22:52:22 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/9211
Author: @stewartjarod
Created: 4/15/2026
Status: 🔄 Open

Base: main ← Head: fix/api-error-preserves-response-headers

📝 Commits (2)

  • 00b0ee6 fix(api): preserve response headers when APIError is thrown
  • 4259b6f fix(api): merge explicit APIError headers with accumulated ctx headers

📊 Changes

4 files changed (+146 additions, -7 deletions)

View changed files

➕ .changeset/api-error-preserves-response-headers.md (+6 -0)
📝 packages/better-auth/src/api/to-auth-endpoints.test.ts (+59 -0)
📝 packages/better-auth/src/api/to-auth-endpoints.ts (+35 -2)
📝 packages/core/src/api/index.ts (+46 -5)

📄 Description

Summary

Closes #8576.

Endpoint handlers that call c.setCookie (e.g. deleteSessionCookie) and then throw APIError had their
Set-Cookie headers silently dropped. createAuthEndpoint now attaches ctx.responseHeaders to the thrown
error via kAPIErrorHeaderSymbol, matching better-call's createMiddleware contract; toAuthEndpoints
reads that symbol first and falls back to e.headers, mirroring the existing after-hooks catch from #7478.

Breaking changes: none.

Test plan

  • Regression test in to-auth-endpoints.test.ts asserts both Set-Cookie values survive an
    UNAUTHORIZED throw
  • pnpm typecheck passes
  • 297 tests in packages/better-auth/src/api pass
  • Changeset: patch for better-auth and @better-auth/core

Summary by cubic

Preserves response headers set before an APIError and merges them with explicit error headers, so cookies and redirects survive error responses. Fixes #8576 and restores expected behavior for flows like deleteSessionCookie.

  • Bug Fixes
    • @better-auth/core: createAuthEndpoint attaches ctx.responseHeaders to thrown APIError via kAPIErrorHeaderSymbol.
    • better-auth: toAuthEndpoints merges accumulated ctx headers with e.headers (append set-cookie, override others like location) so both persist.
    • Tests cover cookie preservation on UNAUTHORIZED and merging with explicit headers.
    • Patch release for @better-auth/core and better-auth.

Written for commit 4259b6f189. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/9211 **Author:** [@stewartjarod](https://github.com/stewartjarod) **Created:** 4/15/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `fix/api-error-preserves-response-headers` --- ### 📝 Commits (2) - [`00b0ee6`](https://github.com/better-auth/better-auth/commit/00b0ee60ea1edb8924f085aeb0175dea18677619) fix(api): preserve response headers when APIError is thrown - [`4259b6f`](https://github.com/better-auth/better-auth/commit/4259b6f1891a39e3acd54644fad86751227c356a) fix(api): merge explicit APIError headers with accumulated ctx headers ### 📊 Changes **4 files changed** (+146 additions, -7 deletions) <details> <summary>View changed files</summary> ➕ `.changeset/api-error-preserves-response-headers.md` (+6 -0) 📝 `packages/better-auth/src/api/to-auth-endpoints.test.ts` (+59 -0) 📝 `packages/better-auth/src/api/to-auth-endpoints.ts` (+35 -2) 📝 `packages/core/src/api/index.ts` (+46 -5) </details> ### 📄 Description ## Summary Closes #8576. Endpoint handlers that call `c.setCookie` (e.g. `deleteSessionCookie`) and then throw `APIError` had their `Set-Cookie` headers silently dropped. `createAuthEndpoint` now attaches `ctx.responseHeaders` to the thrown error via `kAPIErrorHeaderSymbol`, matching better-call's `createMiddleware` contract; `toAuthEndpoints` reads that symbol first and falls back to `e.headers`, mirroring the existing after-hooks catch from #7478. **Breaking changes:** none. ## Test plan - [x] Regression test in `to-auth-endpoints.test.ts` asserts both `Set-Cookie` values survive an `UNAUTHORIZED` throw - [x] `pnpm typecheck` passes - [x] 297 tests in `packages/better-auth/src/api` pass - [x] Changeset: `patch` for `better-auth` and `@better-auth/core` <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Preserves response headers set before an `APIError` and merges them with explicit error headers, so cookies and redirects survive error responses. Fixes #8576 and restores expected behavior for flows like `deleteSessionCookie`. - **Bug Fixes** - `@better-auth/core`: `createAuthEndpoint` attaches `ctx.responseHeaders` to thrown `APIError` via `kAPIErrorHeaderSymbol`. - `better-auth`: `toAuthEndpoints` merges accumulated ctx headers with `e.headers` (append `set-cookie`, override others like `location`) so both persist. - Tests cover cookie preservation on `UNAUTHORIZED` and merging with explicit headers. - Patch release for `@better-auth/core` and `better-auth`. <sup>Written for commit 4259b6f1891a39e3acd54644fad86751227c356a. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 22:52:22 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#25407
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?