github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-08-23 17:58:47 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

CORS Issues with Better Auth on Cloudflare Workers Using Hono Framework #2723

New Issue
Closed
opened 2026-03-13 10:15:20 -05:00 by GiteaMirror · 5 comments
GiteaMirror commented 2026-03-13 10:15:20 -05:00
Owner
Copy Link
Copy Source

Originally created by @Abdelrahman286 on GitHub (Jan 17, 2026).

Originally assigned to: @bytaesu on GitHub.

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

I’m having trouble setting up Cloudflare Workers with Better Auth using the Hono framework. My frontend is a React app running on http://localhost:5173, and my backend is on http://localhost:5174. When I try to access http://localhost:5173/api/auth/sign-up/email, I keep running into a CORS error. I’ve added Hono CORS middleware and included the frontend domain in the trustedOrigins list, but the issue still persists. I’m using Better Auth version 1.4.13.

//index.ts
import { Hono } from "hono";
import { Bindings, Variables } from "./types";

import auth from "./utils/auth";
import { cors } from "hono/cors";

const app = new Hono<{
  Bindings: Bindings;
  Variables: Variables;
}>();

app.use(
  "/api/auth/*", // or replace with "*" to enable cors for all routes
  cors({
    origin: "http://localhost:5173", // replace with your origin
    allowHeaders: ["Content-Type", "Authorization"],
    allowMethods: ["POST", "GET", "OPTIONS"],
    exposeHeaders: ["Content-Length"],
    maxAge: 6000,
    credentials: true,
  }),
);
app.on(["POST", "GET"], "/api/auth/*", (c) => {
  return auth(c.env).handler(c.req.raw);
});
export default app;

import { betterAuth } from "better-auth";
import { drizzleAdapter } from "better-auth/adapters/drizzle";
import { Bindings } from "../types";
import { getDB } from "../db/connectDB";

export default function createAuth(env: Bindings) {
  const db = getDB(env);

  return betterAuth({
    trustedOrigins: ["http://localhost:5173"],

    database: drizzleAdapter(db, {
      provider: "sqlite", // D1 is compatible with SQLite
    }),

    emailAndPassword: {
      enabled: true,
      requireEmailVerification: true,
    },
  });
}

Current vs. Expected behavior

Image

What version of Better Auth are you using?

1.4.13

System info

"version": "#91~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Nov 20 15:20:45 UTC 2",
    "release": "6.8.0-90-generic",
    "cpuCount": 8,
    "cpuModel": "AMD Ryzen 5 3450U with Radeon Vega Mobile Gfx",
    "totalMemory": "13.54 GB",
    "freeMemory": "6.79 GB"
  },
  "node": {
    "version": "v24.12.0",
    "env": "development"
  },
  "packageManager": {
    "name": "npm",
    "version": "11.6.2"
  },
  "frameworks": [
    {
      "name": "react",
      "version": "19.2.1"
    },
    {
      "name": "hono",
      "version": "^4.11.1"
    }
  ],
  "databases": [
    {
      "name": "drizzle",
      "version": "^0.45.1"
    }
  ],
  "betterAuth": {
    "version": "^1.4.13",
    "config": null
  }
}

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

Additional context

No response

Originally created by @Abdelrahman286 on GitHub (Jan 17, 2026). Originally assigned to: @bytaesu on GitHub. ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce I’m having trouble setting up Cloudflare Workers with Better Auth using the Hono framework. My frontend is a React app running on http://localhost:5173, and my backend is on http://localhost:5174. When I try to access http://localhost:5173/api/auth/sign-up/email, I keep running into a CORS error. I’ve added Hono CORS middleware and included the frontend domain in the trustedOrigins list, but the issue still persists. I’m using Better Auth version 1.4.13. ```ts //index.ts import { Hono } from "hono"; import { Bindings, Variables } from "./types"; import auth from "./utils/auth"; import { cors } from "hono/cors"; const app = new Hono<{ Bindings: Bindings; Variables: Variables; }>(); app.use( "/api/auth/*", // or replace with "*" to enable cors for all routes cors({ origin: "http://localhost:5173", // replace with your origin allowHeaders: ["Content-Type", "Authorization"], allowMethods: ["POST", "GET", "OPTIONS"], exposeHeaders: ["Content-Length"], maxAge: 6000, credentials: true, }), ); app.on(["POST", "GET"], "/api/auth/*", (c) => { return auth(c.env).handler(c.req.raw); }); export default app; ``` ```ts import { betterAuth } from "better-auth"; import { drizzleAdapter } from "better-auth/adapters/drizzle"; import { Bindings } from "../types"; import { getDB } from "../db/connectDB"; export default function createAuth(env: Bindings) { const db = getDB(env); return betterAuth({ trustedOrigins: ["http://localhost:5173"], database: drizzleAdapter(db, { provider: "sqlite", // D1 is compatible with SQLite }), emailAndPassword: { enabled: true, requireEmailVerification: true, }, }); } ``` ### Current vs. Expected behavior <img width="1404" height="504" alt="Image" src="https://github.com/user-attachments/assets/5e6701e0-7843-40b5-b19b-ae609baa9890" /> ### What version of Better Auth are you using? 1.4.13 ### System info ```bash "version": "#91~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Nov 20 15:20:45 UTC 2", "release": "6.8.0-90-generic", "cpuCount": 8, "cpuModel": "AMD Ryzen 5 3450U with Radeon Vega Mobile Gfx", "totalMemory": "13.54 GB", "freeMemory": "6.79 GB" }, "node": { "version": "v24.12.0", "env": "development" }, "packageManager": { "name": "npm", "version": "11.6.2" }, "frameworks": [ { "name": "react", "version": "19.2.1" }, { "name": "hono", "version": "^4.11.1" } ], "databases": [ { "name": "drizzle", "version": "^0.45.1" } ], "betterAuth": { "version": "^1.4.13", "config": null } } ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript ``` ### Additional context _No response_
GiteaMirror added the hono label 2026-03-13 10:15:20 -05:00
GiteaMirror commented 2026-03-13 10:15:22 -05:00
Author
Owner
Copy Link
Copy Source

@better-auth-agent[bot] commented on GitHub (Jan 17, 2026):

To address the CORS issue you're experiencing with Better Auth on Cloudflare Workers using the Hono framework, please ensure that your CORS middleware is registered before your authentication routes. This order is important for the CORS configuration to be effective.

Here's a concise checklist and some recommendations based on your setup:

  1. CORS Configuration: Confirm that the origin in your CORS middleware (http://localhost:5173) matches the domain you're accessing. If you're changing the client port later, ensure this is updated accordingly.

  2. Middleware Order: The CORS middleware must be above your route definitions in the app setup. Make sure it looks like this:

    app.use("/api/auth/*", cors({
  origin: "http://localhost:5173",
  allowHeaders: ["Content-Type", "Authorization"],
  allowMethods: ["POST", "GET", "OPTIONS"],
  exposeHeaders: ["Content-Length"],
  maxAge: 6000,
  credentials: true,
}));

app.on(["POST", "GET"], "/api/auth/*", (c) => {
  return auth(c.env).handler(c.req.raw);
});

  3. Credentials: Your CORS configuration is correctly set for credentials. Make sure in your client-side code (if applicable) that requests are configured to include credentials, like so:

    fetch(url, {
  method: 'POST',
  credentials: 'include', // This is key for sending cookies
});

  4. Version Compatibility: You are using Better Auth version 1.4.13. Ensure you are up to date with any patches related to CORS issues that may have been released recently.

If you still encounter issues after confirming the above, feel free to reach out to @bekacru or @ping__ for further assistance!

Is there anything specific you'd like to troubleshoot further?

If you need more help, tag @better-auth-agent in a comment so I can respond.

Diagram • Discord • GitHub

Diagram Join Star

@better-auth-agent[bot] commented on GitHub (Jan 17, 2026): To address the CORS issue you're experiencing with Better Auth on Cloudflare Workers using the Hono framework, please ensure that your CORS middleware is registered before your authentication routes. This order is important for the CORS configuration to be effective. Here's a concise checklist and some recommendations based on your setup: 1. **CORS Configuration**: Confirm that the `origin` in your CORS middleware (`http://localhost:5173`) matches the domain you're accessing. If you're changing the client port later, ensure this is updated accordingly. 2. **Middleware Order**: The CORS middleware must be above your route definitions in the app setup. Make sure it looks like this: ```ts app.use("/api/auth/*", cors({ origin: "http://localhost:5173", allowHeaders: ["Content-Type", "Authorization"], allowMethods: ["POST", "GET", "OPTIONS"], exposeHeaders: ["Content-Length"], maxAge: 6000, credentials: true, })); app.on(["POST", "GET"], "/api/auth/*", (c) => { return auth(c.env).handler(c.req.raw); }); ``` 3. **Credentials**: Your CORS configuration is correctly set for credentials. Make sure in your client-side code (if applicable) that requests are configured to include credentials, like so: ```javascript fetch(url, { method: 'POST', credentials: 'include', // This is key for sending cookies }); ``` 4. **Version Compatibility**: You are using Better Auth version 1.4.13. Ensure you are up to date with any patches related to CORS issues that may have been released recently. If you still encounter issues after confirming the above, feel free to reach out to @bekacru or @ping__ for further assistance! Is there anything specific you'd like to troubleshoot further? _If you need more help, tag @better-auth-agent in a comment so I can respond._ <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-03-13 10:15:23 -05:00
Author
Owner
Copy Link
Copy Source

@bytaesu commented on GitHub (Jan 17, 2026):

My frontend is a React app running on http://localhost:5174/, and my backend is on http://localhost:5173/

Hi @Abdelrahman286,

I think setting http://localhost:5174/ in both the CORS middleware and auth trustedOrigins should fix it 🙂

@bytaesu commented on GitHub (Jan 17, 2026): > My frontend is a React app running on http://localhost:5174/, and my backend is on http://localhost:5173/ Hi @Abdelrahman286, I think setting http://localhost:5174/ in both the CORS middleware and auth trustedOrigins should fix it 🙂
GiteaMirror commented 2026-03-13 10:15:23 -05:00
Author
Owner
Copy Link
Copy Source

@Abdelrahman286 commented on GitHub (Jan 17, 2026):

@bytaesu I did that and it didn't solve the CORS Issue

@Abdelrahman286 commented on GitHub (Jan 17, 2026): @bytaesu I did that and it didn't solve the CORS Issue
GiteaMirror commented 2026-03-13 10:15:24 -05:00
Author
Owner
Copy Link
Copy Source

@bytaesu commented on GitHub (Jan 17, 2026):

@Abdelrahman286

Actually, CORS is not related to the Better Auth configuration.

You can find a working example in the link below that runs without issues.

If this issue persists, could you share a reproducible repo with me?

https://github.com/bytaesu/better-auth-separate-backend

@bytaesu commented on GitHub (Jan 17, 2026): @Abdelrahman286 Actually, CORS is not related to the Better Auth configuration. You can find a working example in the link below that runs without issues. If this issue persists, could you share a reproducible repo with me? https://github.com/bytaesu/better-auth-separate-backend
GiteaMirror commented 2026-03-13 10:15:25 -05:00
Author
Owner
Copy Link
Copy Source

@bytaesu commented on GitHub (Jan 22, 2026):

This doesn’t seem to be an actual issue, so I’ll close it. Feel free to mention me or reopen if the issue persists.

@bytaesu commented on GitHub (Jan 22, 2026): This doesn’t seem to be an actual issue, so I’ll close it. Feel free to mention me or reopen if the issue persists.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels hono
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#2723