github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 08:01:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #6435] Inconsistent cookie name construction logic between session_data and session_token #27835

New Issue
Closed
opened 2026-04-17 19:03:50 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-17 19:03:50 -05:00
Owner
Copy Link

Originally created by @kallimat on GitHub (Dec 1, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/6435

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

7a0f32b706/packages/better-auth/src/cookies/index.ts (L402-L417)

7a0f32b706/packages/better-auth/src/cookies/index.ts (L345-L368)

Current vs. Expected behavior

There is a discrepancy in how cookie names are constructed in src/cookies/index.ts. Two different logic flows are currently being used to generate cookie names, leading to potential inconsistencies (such as double separators or mismatched naming conventions) when custom configurations are applied.

The Discrepancy:

Block A (Lines 402-417): This block enforces a dot (.) separator directly in the template literal. It assumes the prefix does not contain a separator.

What version of Better Auth are you using?

latest

System info

--

Which area(s) are affected? (Select all that apply)

Package

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  emailAndPassword: {  
    enabled: true
  },
});

Additional context

No response

Originally created by @kallimat on GitHub (Dec 1, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/6435 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce https://github.com/better-auth/better-auth/blob/7a0f32b706f8a3e34dada80dbb94a3f2b8b06f60/packages/better-auth/src/cookies/index.ts#L402-L417 https://github.com/better-auth/better-auth/blob/7a0f32b706f8a3e34dada80dbb94a3f2b8b06f60/packages/better-auth/src/cookies/index.ts#L345-L368 ### Current vs. Expected behavior There is a discrepancy in how cookie names are constructed in src/cookies/index.ts. Two different logic flows are currently being used to generate cookie names, leading to potential inconsistencies (such as double separators or mismatched naming conventions) when custom configurations are applied. The Discrepancy: Block A (Lines 402-417): This block enforces a dot (.) separator directly in the template literal. It assumes the prefix does not contain a separator. ### What version of Better Auth are you using? latest ### System info ```bash -- ``` ### Which area(s) are affected? (Select all that apply) Package ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ emailAndPassword: { enabled: true }, }); ``` ### Additional context _No response_
GiteaMirror added the lockedbug labels 2026-04-17 19:03:50 -05:00
GiteaMirror commented 2026-04-17 19:03:51 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Dec 1, 2025):

Hi there, thanks for opening this issue! It looks like the discrepancy in cookie name construction between session_data and session_token is causing inconsistencies, potentially with double separators or mismatched naming when custom configurations are applied. A good next step is to verify that your custom settings (like the cookie prefix) align consistently across both logic flows. Specifically, review your configuration to ensure that advanced.cookiePrefix and session.cookieName work together seamlessly. This might involve consolidating the cookie naming logic into a single helper so that both cookies are constructed using the same pattern.

Tag @better-auth-agent if you would like an answer from the Agent. Can you share more details on any custom cookie configurations you have applied?

If you need more help, tag @Skyvern in a comment so I can respond.

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3594185289 --> @better-auth-agent[bot] commented on GitHub (Dec 1, 2025): Hi there, thanks for opening this issue! It looks like the discrepancy in cookie name construction between session_data and session_token is causing inconsistencies, potentially with double separators or mismatched naming when custom configurations are applied. A good next step is to verify that your custom settings (like the cookie prefix) align consistently across both logic flows. Specifically, review your configuration to ensure that advanced.cookiePrefix and session.cookieName work together seamlessly. This might involve consolidating the cookie naming logic into a single helper so that both cookies are constructed using the same pattern. Tag @better-auth-agent if you would like an answer from the Agent. Can you share more details on any custom cookie configurations you have applied? _If you need more help, tag @Skyvern in a comment so I can respond._ <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) • [Discord](https://discord.gg/fG2XXEuQX3) • [GitHub](https://github.com/Skyvern-AI/Skyvern) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/fG2XXEuQX3) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/Skyvern-AI/Skyvern)
GiteaMirror commented 2026-04-17 19:03:51 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Dec 1, 2025):

Hi @kallimat! I'm Dosu and I’m helping the better-auth team.

You're right—there's an inconsistency in how cookie names are constructed for session_data and session_token in Better Auth. The logic for building cookie names uses different separators and flows: session_token typically uses a dot (.) between the prefix and name, while getSessionCookie sometimes inserts a dash (-) if a custom name is present, which can lead to double separators or mismatched names when custom configs are used. This can break cookie parsing and session retrieval, especially if you override cookiePrefix or cookieName in your config. The same issue can affect chunked cookies and secure prefixes as well.

There's an open pull request addressing this exact problem, proposing to unify the logic and avoid these mismatches by reusing the construction flow from getCookieCache in getSessionCookie and ensuring that custom names aren't double-prefixed or incorrectly concatenated. You can track the status of this fix here: PR #5837.

For now, the best workaround is to avoid manually adding separators to your cookiePrefix or cookieName—let Better Auth handle them internally. If you set a custom cookie name, make sure you don't include the prefix or separator in the name itself, and pass the prefix as a separate config value. This will help avoid parsing issues until the fix is merged. For more details and config examples, see the discussion on cookie prefix handling.

If you need to retrieve a cookie by a custom name, ensure you pass an empty string for cookiePrefix in the getter function to avoid double-prefixing, as suggested in the PR.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

<!-- gh-comment-id:3594188163 --> @dosubot[bot] commented on GitHub (Dec 1, 2025): <!-- Greeting --> Hi @kallimat! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the better-auth team. <!-- Answer --> You're right—there's an inconsistency in how cookie names are constructed for `session_data` and `session_token` in Better Auth. The logic for building cookie names uses different separators and flows: `session_token` typically uses a dot (`.`) between the prefix and name, while `getSessionCookie` sometimes inserts a dash (`-`) if a custom name is present, which can lead to double separators or mismatched names when custom configs are used. This can break cookie parsing and session retrieval, especially if you override `cookiePrefix` or `cookieName` in your config. The same issue can affect chunked cookies and secure prefixes as well. There's an open pull request addressing this exact problem, proposing to unify the logic and avoid these mismatches by reusing the construction flow from `getCookieCache` in `getSessionCookie` and ensuring that custom names aren't double-prefixed or incorrectly concatenated. You can track the status of this fix here: [PR #5837](https://github.com/better-auth/better-auth/pull/5837). For now, the best workaround is to avoid manually adding separators to your `cookiePrefix` or `cookieName`—let Better Auth handle them internally. If you set a custom cookie name, make sure you don't include the prefix or separator in the name itself, and pass the prefix as a separate config value. This will help avoid parsing issues until the fix is merged. For more details and config examples, see the discussion on [cookie prefix handling](https://github.com/better-auth/better-auth/discussions/3949). If you need to retrieve a cookie by a custom name, ensure you pass an empty string for `cookiePrefix` in the getter function to avoid double-prefixing, as suggested in the PR. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/52f087b8-52df-4a10-9d6d-456978b23c24?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/52f087b8-52df-4a10-9d6d-456978b23c24?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/52f087b8-52df-4a10-9d6d-456978b23c24?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/52f087b8-52df-4a10-9d6d-456978b23c24?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/52f087b8-52df-4a10-9d6d-456978b23c24?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/52f087b8-52df-4a10-9d6d-456978b23c24?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/52f087b8-52df-4a10-9d6d-456978b23c24?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=You%27re%20right%E2%80%94there%27s%20an%20inconsistency%20in%20how%20cookie%20names%20are%20constructed%20for%20%60session_data%60%20and%20%60session_token%60%20in%20Better%20Auth.%20The%20logic%20for%20building%20cookie%20names%20uses%20different%20separators%20and%20flows%3A%20%60session_token%60%20typically%20uses%20a%20dot%20%28%60.%60%29%20between%20the%20prefix%20and%20name%2C%20while%20%60getSessionCookie%60%20sometimes%20inserts%20a%20dash%20%28%60-%60%29%20if%20a%20custom%20name%20is%20present%2C%20which%20can%20lead%20to%20double%20separators%20or%20mismatched%20names%20when%20custom%20configs%20are%20used.%20This%20can%20break%20cookie%20parsing%20and%20session%20retrieval%2C%20especially%20if%20you%20override%20%60cookiePrefix%60%20or%20%60cookieName%60%20in%20your%20config.%20The%20same%20issue%20can%20affect%20chunked%20cookies%20and%20secure%20prefixes%20as%20well.%0A%0AThere%27s%20an%20open%20pull%20request%20addressing%20this%20exact%20problem%2C%20proposing%20to%20unify%20the%20logic%20and%20avoid%20these%20mismatches%20by%20reusing%20the%20construction%20flow%20from%20%60getCookieCache%60%20in%20%60getSessionCookie%60%20and%20ensuring%20that%20custom%20names%20aren%27t%20double-prefixed%20or%20incorrectly%20concatenated.%20You%20can%20track%20the%20status%20of%20this%20fix%20here%3A%20%5BPR%20%235837%5D%28https%3A//github.com/better-auth/better-auth/pull/5837%29.%0A%0AFor%20now%2C%20the%20best%20workaround%20is%20to%20avoid%20manually%20adding%20separators%20to%20your%20%60cookiePrefix%60%20or%20%60cookieName%60%E2%80%94let%20Better%20Auth%20handle%20them%20internally.%20If%20you%20set%20a%20custom%20cookie%20name%2C%20make%20sure%20you%20don%27t%20include%20the%20prefix%20or%20separator%20in%20the%20name%20itself%2C%20and%20pass%20the%20prefix%20as%20a%20separate%20config%20value.%20This%20will%20help%20avoid%20parsing%20issues%20until%20the%20fix%20is%20merged.%20For%20more%20details%20and%20config%20examples%2C%20see%20the%20discussion%20on%20%5Bcookie%20prefix%20handling%5D%28https%3A//github.com/better-auth/better-auth/discussions/3949%29.%0A%0AIf%20you%20need%20to%20retrieve%20a%20cookie%20by%20a%20custom%20name%2C%20ensure%20you%20pass%20an%20empty%20string%20for%20%60cookiePrefix%60%20in%20the%20getter%20function%20to%20avoid%20double-prefixing%2C%20as%20suggested%20in%20the%20PR.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/6435)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#27835
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?