github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #2184] admin_session cookie doesn't respect the configured cookie prefix #26413

New Issue
Closed
opened 2026-04-17 16:58:29 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-17 16:58:29 -05:00
Owner
Copy Link

Originally created by @MarcMogdanz on GitHub (Apr 8, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/2184

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

Impersonate another user to trigger the creation of the admin_session cookie

Current vs. Expected behavior

Instead of admin_session the cookie should be called $prefix.admin_session just like the normal $prefix.session_token

What version of Better Auth are you using?

1.2.5

Provide environment information

-

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

import { betterAuth } from "better-auth"
import { admin } from 'better-auth/plugins'
export const auth = betterAuth({
  emailAndPassword: {  
    enabled: true
  },
  advanced: {
    cookiePrefix: 'prefix',
  },
  plugins: [admin()]
});

Additional context

No response

Originally created by @MarcMogdanz on GitHub (Apr 8, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/2184 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce Impersonate another user to trigger the creation of the `admin_session` cookie ### Current vs. Expected behavior Instead of `admin_session` the cookie should be called `$prefix.admin_session` just like the normal `$prefix.session_token` ### What version of Better Auth are you using? 1.2.5 ### Provide environment information ```bash - ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" import { admin } from 'better-auth/plugins' export const auth = betterAuth({ emailAndPassword: { enabled: true }, advanced: { cookiePrefix: 'prefix', }, plugins: [admin()] }); ``` ### Additional context _No response_
GiteaMirror added the locked label 2026-04-17 16:58:30 -05:00
GiteaMirror commented 2026-04-17 16:58:32 -05:00
Author
Owner
Copy Link

@Kinfe123 commented on GitHub (Apr 12, 2025):

i dont think there is an issue of using the name ofadmin_session. it is just sth that we used to keep track the admin while impersonating.

<!-- gh-comment-id:2798817614 --> @Kinfe123 commented on GitHub (Apr 12, 2025): i dont think there is an issue of using the name of`admin_session`. it is just sth that we used to keep track the admin while impersonating.
GiteaMirror commented 2026-04-17 16:58:33 -05:00
Author
Owner
Copy Link

@MarcMogdanz commented on GitHub (Apr 13, 2025):

i dont think there is an issue of using the name ofadmin_session. it is just sth that we used to keep track the admin while impersonating.

I get the use case, but I don't get why it's not using the prefix since it's also just a cookie like the actual session token.

In the docs it says cookiePrefix: Prefix for cookies so I'd assume this goes for all cookies set by better-auth

<!-- gh-comment-id:2799887833 --> @MarcMogdanz commented on GitHub (Apr 13, 2025): > i dont think there is an issue of using the name of`admin_session`. it is just sth that we used to keep track the admin while impersonating. I get the use case, but I don't get why it's not using the prefix since it's also just a cookie like the actual session token. In the docs it says [`cookiePrefix: Prefix for cookies`](https://www.better-auth.com/docs/reference/options#advanced) so I'd assume this goes for all cookies set by better-auth
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#26413
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?