github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 16:11:53 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

session_data cookie not regenerating after expiry when using twoFactor plugin #2771

New Issue
Closed
opened 2026-03-13 10:19:15 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-03-13 10:19:15 -05:00
Owner
Copy Link

Originally created by @Solomonkassa on GitHub (Jan 27, 2026).

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

session_data cookie not regenerating after expiry when using twoFactor plugin

Current vs. Expected behavior

session_data cookie not regenerating after expiry when using twoFactor plugin

What version of Better Auth are you using?

1.0.0

System info

session_data cookie not regenerating after expiry when using twoFactor plugin

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  emailAndPassword: {  
    enabled: true
  },
});

Additional context

session_data cookie not regenerating after expiry when using twoFactor plugin

Originally created by @Solomonkassa on GitHub (Jan 27, 2026). ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce session_data cookie not regenerating after expiry when using twoFactor plugin ### Current vs. Expected behavior session_data cookie not regenerating after expiry when using twoFactor plugin ### What version of Better Auth are you using? 1.0.0 ### System info ```bash session_data cookie not regenerating after expiry when using twoFactor plugin ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ emailAndPassword: { enabled: true }, }); ``` ### Additional context session_data cookie not regenerating after expiry when using twoFactor plugin
GiteaMirror added the bug label 2026-03-13 10:19:15 -05:00
GiteaMirror commented 2026-03-13 10:19:16 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Jan 27, 2026):

It seems you've encountered an issue with the session_data cookie not regenerating after it expires when using the twoFactor plugin with Better Auth. This is indeed recognized as a bug within the Better Auth community and has been discussed in detail.

Current Understanding

  1. When using cookieCache with the twoFactor plugin, the session_data cookie can fail to regenerate after its expiry. Although the session_token still persists, the user is logged out because session_data is not restored.
  2. If cookieCache is entirely disabled, you’ll encounter issues with TOTP verification failing, indicating that twoFactor relies on cookieCache to store the pending 2FA state.

Workaround

A suggested workaround is to set the maxAge of cookieCache to be equal to the session expiresIn value. This will prevent logouts due to session data expiration, although it's not an ideal solution, it helps mitigate the issue:

cookieCache: {
  enabled: true,
  maxAge: 60 * 60 * 24 * 7,  // Adjust to match session expiresIn
  strategy: "compact",
},

Next Steps

If you have followed the above and the issue persists, it's good to monitor updates in the GitHub repository for any fixes, as this is an ongoing discussion in the community.

Feel free to tag the Better Auth team members, Beka (@bekacru) or Max (@ping__), if you need more specific support or have further questions! What have you tried so far in troubleshooting this issue?

If you need more help, tag @better-auth-agent in a comment so I can respond.

Diagram • Discord • GitHub

Diagram Join Star

@better-auth-agent[bot] commented on GitHub (Jan 27, 2026): It seems you've encountered an issue with the `session_data` cookie not regenerating after it expires when using the twoFactor plugin with Better Auth. This is indeed recognized as a bug within the Better Auth community and has been discussed in detail. ### Current Understanding 1. When using `cookieCache` with the `twoFactor` plugin, the `session_data` cookie can fail to regenerate after its expiry. Although the `session_token` still persists, the user is logged out because `session_data` is not restored. 2. If `cookieCache` is entirely disabled, you’ll encounter issues with TOTP verification failing, indicating that `twoFactor` relies on `cookieCache` to store the pending 2FA state. ### Workaround A suggested workaround is to set the `maxAge` of `cookieCache` to be equal to the session `expiresIn` value. This will prevent logouts due to session data expiration, although it's not an ideal solution, it helps mitigate the issue: ```typescript cookieCache: { enabled: true, maxAge: 60 * 60 * 24 * 7, // Adjust to match session expiresIn strategy: "compact", }, ``` ### Next Steps If you have followed the above and the issue persists, it's good to monitor updates in the GitHub repository for any fixes, as this is an ongoing discussion in the community. Feel free to tag the Better Auth team members, Beka (@bekacru) or Max (@ping__), if you need more specific support or have further questions! What have you tried so far in troubleshooting this issue? _If you need more help, tag @better-auth-agent in a comment so I can respond._ <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-03-13 10:19:16 -05:00
Author
Owner
Copy Link

@amankumarconnect commented on GitHub (Jan 27, 2026):

After looking into this further, it appears this is a duplicate of #7607 .

That issue describes the exact same behavior regarding session_data expiration with the twoFactor plugin but includes significantly more detailed system information (v1.4.17) and reproduction steps.

@amankumarconnect commented on GitHub (Jan 27, 2026): After looking into this further, it appears this is a duplicate of #7607 . That issue describes the exact same behavior regarding `session_data` expiration with the `twoFactor` plugin but includes significantly more detailed system information (v1.4.17) and reproduction steps.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#2771
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?