github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #4412] Bug: getSession with asResponse: true doesn't return a Response #27246

New Issue
Closed
opened 2026-04-17 18:09:30 -05:00 by GiteaMirror · 4 comments
GiteaMirror commented 2026-04-17 18:09:30 -05:00
Owner
Copy Link

Originally created by @walker-tx on GitHub (Sep 3, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/4412

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

To reproduce, add the API Key Plugin to an auth config, and then call getSession like so:

const sessionResponse = await auth.api.getSession({
    headers: new Headers({ 'x-api-key': apiKey }),
    asResponse: true
});

Current vs. Expected behavior

Even though TS thinks it's returning a Response object, the function is actually returning a Session object.

What version of Better Auth are you using?

1.3.7

System info

System:
    OS: macOS 15.6.1
    CPU: (8) arm64 Apple M3
    Memory: 178.84 MB / 24.00 GB
    Shell: 5.9 - /bin/zsh
  Browsers:
    Chrome: 139.0.7258.155
    Safari: 18.6

Which area(s) are affected? (Select all that apply)

Backend, Types

Auth config (if applicable)

import { betterAuth } from "better-auth"

export const auth = betterAuth({
  secret: BETTER_AUTH_SECRET,
  user: {
    deleteUser: { enabled: true }
  },
  database: drizzleAdapter(db, {
    provider: 'pg',
    schema: schemas,
    usePlural: true
  }),
  emailAndPassword: {
    enabled: true,
    autoSignIn: false
  },

  plugins: [
    sveltekitCookies(getRequestEvent),
    apiKey({
      rateLimit: { enabled: false },
      schema: {
        apikey: {
          fields: {}
        }
      }
    }),
    jwt({
      jwks: {
        keyPairConfig: {
          alg: 'ES256'
        }
      }
    }),
    oidcProvider({
      loginPage: '/sign-in',
      storeClientSecret: 'encrypted',
      allowDynamicClientRegistration: true,
      consentPage: '/oauth2/consent'
    })
  ]
});

Additional context

I was hoping to use this in conjuction with the JWT plugin to both verify the API key and to get a JWT to authenticate the user for other services.

Originally created by @walker-tx on GitHub (Sep 3, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/4412 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce To reproduce, add the `API Key Plugin` to an auth config, and then call `getSession` like so: ```typescript const sessionResponse = await auth.api.getSession({ headers: new Headers({ 'x-api-key': apiKey }), asResponse: true }); ``` ### Current vs. Expected behavior Even though TS thinks it's returning a `Response` object, the function is actually returning a Session object. ### What version of Better Auth are you using? 1.3.7 ### System info ```bash System: OS: macOS 15.6.1 CPU: (8) arm64 Apple M3 Memory: 178.84 MB / 24.00 GB Shell: 5.9 - /bin/zsh Browsers: Chrome: 139.0.7258.155 Safari: 18.6 ``` ### Which area(s) are affected? (Select all that apply) Backend, Types ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ secret: BETTER_AUTH_SECRET, user: { deleteUser: { enabled: true } }, database: drizzleAdapter(db, { provider: 'pg', schema: schemas, usePlural: true }), emailAndPassword: { enabled: true, autoSignIn: false }, plugins: [ sveltekitCookies(getRequestEvent), apiKey({ rateLimit: { enabled: false }, schema: { apikey: { fields: {} } } }), jwt({ jwks: { keyPairConfig: { alg: 'ES256' } } }), oidcProvider({ loginPage: '/sign-in', storeClientSecret: 'encrypted', allowDynamicClientRegistration: true, consentPage: '/oauth2/consent' }) ] }); ``` ### Additional context I was hoping to use this in conjuction with the JWT plugin to both verify the API key and to get a JWT to authenticate the user for other services.
GiteaMirror added the lockedbug labels 2026-04-17 18:09:30 -05:00
GiteaMirror commented 2026-04-17 18:09:32 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Sep 3, 2025):

Hi @walker-tx! I'm Dosu and I’m helping the better-auth team.

You've found a real bug: when the API Key plugin is enabled, its middleware intercepts requests to /get-session and returns a plain session object directly, instead of letting the core handler return a Response object as expected when using asResponse: true. This breaks the contract that TypeScript and the docs promise, and is not the intended behavior—getSession({ asResponse: true }) should always return a Response object, which you can then parse with .json() (see code).

This isn't caused by your config or usage; it's a bug in the API Key plugin's middleware, which short-circuits the route and bypasses the normal API endpoint handler (see code). There are no recent fixes or workarounds in the latest releases or PRs (see PR #4091).

As a workaround, you could manually wrap the returned session object in a Response yourself, but this is only a patch and not a real fix. The correct fix would be for the API Key plugin to always delegate to the core session handler so the return type matches the contract.

Let me know if you want a code snippet for a temporary workaround.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

<!-- gh-comment-id:3251122414 --> @dosubot[bot] commented on GitHub (Sep 3, 2025): <!-- Greeting --> Hi @walker-tx! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the better-auth team. <!-- Answer --> You've found a real bug: when the API Key plugin is enabled, its middleware intercepts requests to `/get-session` and returns a plain session object directly, instead of letting the core handler return a Response object as expected when using `asResponse: true`. This breaks the contract that TypeScript and the docs promise, and is not the intended behavior—`getSession({ asResponse: true })` should always return a Response object, which you can then parse with `.json()` [(see code)](https://github.com/better-auth/better-auth/blob/9b966f0bbfcbfc8c981e02af8ec827993c3760ee/packages/better-auth/src/plugins/api-key/index.ts). This isn't caused by your config or usage; it's a bug in the API Key plugin's middleware, which short-circuits the route and bypasses the normal API endpoint handler [(see code)](https://github.com/better-auth/better-auth/blob/9b966f0bbfcbfc8c981e02af8ec827993c3760ee/packages/better-auth/src/api/routes/session.ts). There are no recent fixes or workarounds in the latest releases or PRs [(see PR #4091)](https://github.com/better-auth/better-auth/pull/4091). As a workaround, you could manually wrap the returned session object in a Response yourself, but this is only a patch and not a real fix. The correct fix would be for the API Key plugin to always delegate to the core session handler so the return type matches the contract. Let me know if you want a code snippet for a temporary workaround. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/faa8f506-30f2-4e51-b41c-40a02987bcfb?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/faa8f506-30f2-4e51-b41c-40a02987bcfb?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/faa8f506-30f2-4e51-b41c-40a02987bcfb?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/faa8f506-30f2-4e51-b41c-40a02987bcfb?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/faa8f506-30f2-4e51-b41c-40a02987bcfb?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/faa8f506-30f2-4e51-b41c-40a02987bcfb?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/faa8f506-30f2-4e51-b41c-40a02987bcfb?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/4412)
GiteaMirror commented 2026-04-17 18:09:33 -05:00
Author
Owner
Copy Link

@ping-maxwell commented on GitHub (Dec 3, 2025):

Hey @walker-tx, testing myself on latest version of better-auth I can see the response correctly. This could had been solved already.

<!-- gh-comment-id:3608424383 --> @ping-maxwell commented on GitHub (Dec 3, 2025): Hey @walker-tx, testing myself on latest version of better-auth I can see the response correctly. This could had been solved already.
GiteaMirror commented 2026-04-17 18:09:34 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Dec 3, 2025):

Thanks for the update, @ping-maxwell! We appreciate you checking on this. We'll go ahead and close the issue now.

<!-- gh-comment-id:3608436978 --> @dosubot[bot] commented on GitHub (Dec 3, 2025): Thanks for the update, @ping-maxwell! We appreciate you checking on this. We'll go ahead and close the issue now.
GiteaMirror commented 2026-04-17 18:09:36 -05:00
Author
Owner
Copy Link

@ping-maxwell commented on GitHub (Dec 3, 2025):

I'm closing this as it's solved on latest. Feel free to reopen if this is still a valid issue on the latest version.

<!-- gh-comment-id:3608449431 --> @ping-maxwell commented on GitHub (Dec 3, 2025): I'm closing this as it's solved on latest. Feel free to reopen if this is still a valid issue on the latest version.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#27246
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?