github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 16:11:53 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #1458] set-cookie not present in getSession header with disableCookieCache when customSession is used #26087

New Issue
Closed
opened 2026-04-17 16:31:24 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-17 16:31:24 -05:00
Owner
Copy Link

Originally created by @IronHeartDan on GitHub (Feb 16, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/1458

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

Server Side: add customSession in plugins

customSession(async ({ session, user }) => {
      return {
        ...session,
        user: {
          ...user,
          customField: "customValue",
        },
      };
    }),

Client Side:

await authClient.getSession({
      query: {
        disableCookieCache: true,
      },
    });
Image

Current vs. Expected behavior

 await authClient.getSession({
      query: {
        disableCookieCache: true,
      },
    });

When using this, the response should include fresh cookie in header with set-cookie
Image

What version of Better Auth are you using?

1.1.17

Provide environment information

- OS [Mac]
- Browser [Chrome]

Which area(s) are affected? (Select all that apply)

Backend, Client

Auth config (if applicable)

import { betterAuth } from "better-auth";
import { customSession, emailOTP, phoneNumber } from "better-auth/plugins";
import Database from "better-sqlite3";
import { expo } from "@better-auth/expo";

export const auth = betterAuth({
  database: new Database("./src/db/sqlite.db"),
  trustedOrigins: ["*"],
  session: {
    cookieCache: {
      enabled: true,
      maxAge: 60 * 5,
    },
  },
  user: {
    changeEmail: {
      enabled: true,
      sendChangeEmailVerification: async (
        { user, newEmail, url, token },
        request
      ) => {
        console.log("Sending email to", user.email, "with url", url);
      },
    },
  },
  emailVerification: {
    sendVerificationEmail: async ({ user, url, token }, request) => {
      console.log("Sending email to", user.email, "with url", url);
    },
  },
  plugins: [
    expo(),
    customSession(async ({ session, user }) => {
      return {
        ...session,
        user: {
          ...user,
          customField: "customValue",
        },
      };
    }),
    phoneNumber({
      sendOTP: ({ phoneNumber, code }, request) => {
        console.log("Sending OTP to", phoneNumber, "with code", code);
      },
      signUpOnVerification: {
        getTempEmail: (phoneNumber) => {
          return `${phoneNumber}@mail.com`;
        },
        getTempName: (phoneNumber) => {
          return phoneNumber;
        },
      },
    }),
    emailOTP({
      async sendVerificationOTP({ email, otp, type }) {
        console.log("Sending OTP to", email, "with code", otp);
      },
    }),
  ],
});

Additional context

When customSession is removed, set-cookie is present in getSession response header

Originally created by @IronHeartDan on GitHub (Feb 16, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/1458 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce Server Side: add customSession in plugins ``` customSession(async ({ session, user }) => { return { ...session, user: { ...user, customField: "customValue", }, }; }), ``` Client Side: ``` await authClient.getSession({ query: { disableCookieCache: true, }, }); ``` <img width="801" alt="Image" src="https://github.com/user-attachments/assets/01ecaefc-b73b-4c51-8cfa-4dc2557197f1" /> ### Current vs. Expected behavior ``` await authClient.getSession({ query: { disableCookieCache: true, }, }); ``` When using this, the response should include fresh cookie in header with set-cookie <img width="801" alt="Image" src="https://github.com/user-attachments/assets/8545083f-5724-4739-b5d2-9a909de477f7" /> ### What version of Better Auth are you using? 1.1.17 ### Provide environment information ```bash - OS [Mac] - Browser [Chrome] ``` ### Which area(s) are affected? (Select all that apply) Backend, Client ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth"; import { customSession, emailOTP, phoneNumber } from "better-auth/plugins"; import Database from "better-sqlite3"; import { expo } from "@better-auth/expo"; export const auth = betterAuth({ database: new Database("./src/db/sqlite.db"), trustedOrigins: ["*"], session: { cookieCache: { enabled: true, maxAge: 60 * 5, }, }, user: { changeEmail: { enabled: true, sendChangeEmailVerification: async ( { user, newEmail, url, token }, request ) => { console.log("Sending email to", user.email, "with url", url); }, }, }, emailVerification: { sendVerificationEmail: async ({ user, url, token }, request) => { console.log("Sending email to", user.email, "with url", url); }, }, plugins: [ expo(), customSession(async ({ session, user }) => { return { ...session, user: { ...user, customField: "customValue", }, }; }), phoneNumber({ sendOTP: ({ phoneNumber, code }, request) => { console.log("Sending OTP to", phoneNumber, "with code", code); }, signUpOnVerification: { getTempEmail: (phoneNumber) => { return `${phoneNumber}@mail.com`; }, getTempName: (phoneNumber) => { return phoneNumber; }, }, }), emailOTP({ async sendVerificationOTP({ email, otp, type }) { console.log("Sending OTP to", email, "with code", otp); }, }), ], }); ``` ### Additional context When customSession is removed, set-cookie is present in getSession response header
GiteaMirror added the lockedbug labels 2026-04-17 16:31:25 -05:00
GiteaMirror commented 2026-04-17 16:31:26 -05:00
Author
Owner
Copy Link

@IronHeartDan commented on GitHub (Feb 16, 2025):

session.ts

var getSessionFromCtx = async (ctx, config) => {
  if (ctx.context.session) {
    return ctx.context.session;
  }
  const session = await getSession()({
    ...ctx,
    _flag: "json",
    headers: ctx.headers,
    query: config                    // I think this is the problem the query is overwritten by config
  }).catch((e) => {
    return null;
  });
  ctx.context.session = session;
  return session;
};
<!-- gh-comment-id:2661452118 --> @IronHeartDan commented on GitHub (Feb 16, 2025): session.ts ``` var getSessionFromCtx = async (ctx, config) => { if (ctx.context.session) { return ctx.context.session; } const session = await getSession()({ ...ctx, _flag: "json", headers: ctx.headers, query: config // I think this is the problem the query is overwritten by config }).catch((e) => { return null; }); ctx.context.session = session; return session; }; ```
GiteaMirror commented 2026-04-17 16:31:26 -05:00
Author
Owner
Copy Link

@dennisjnnh commented on GitHub (Apr 3, 2025):

i still experience this issue and have provided a repro here #2106

<!-- gh-comment-id:2776458071 --> @dennisjnnh commented on GitHub (Apr 3, 2025): i still experience this issue and have provided a repro here #2106
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#26087
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?