github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 16:11:53 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #6777] Need for a refresh user sessions utility #27948

New Issue
Open
opened 2026-04-17 19:14:08 -05:00 by GiteaMirror · 3 comments
GiteaMirror commented 2026-04-17 19:14:08 -05:00
Owner
Copy Link

Originally created by @pauksztello on GitHub (Dec 15, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/6777

Is this suited for github?

  • Yes, this is suited for github

Is your feature request related to a problem? Please describe.

Hello,

I was looking for a way to refresh user sessions, but I couldn’t find one. I think this is a crucial feature for custom implementations.

For example, if we set user access ourselves in a webhook when a purchase event is received, we need to update the user’s access field in the database. When we do that, we also need to update any active sessions that include that user. That’s tricky because Better Auth doesn’t expose an API for this use case.

Describe the solution you'd like

The best-case scenario would be a server-side auth method that allows us to update the user's private fields (with input: false) and automatically updates sessions accordingly. Alternatively, providing a server-side utility like refreshSessions would also work.

Describe alternatives you've considered

Right now, I’m using refreshUserSession, which is used internally by better-auth.

Additional context

Im also wondering why is refreshUserSession is being called twice here

Originally created by @pauksztello on GitHub (Dec 15, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/6777 ### Is this suited for github? - [x] Yes, this is suited for github ### Is your feature request related to a problem? Please describe. Hello, I was looking for a way to refresh user sessions, but I couldn’t find one. I think this is a crucial feature for custom implementations. For example, if we set user access ourselves in a webhook when a purchase event is received, we need to update the user’s access field in the database. When we do that, we also need to update any active sessions that include that user. That’s tricky because Better Auth doesn’t expose an API for this use case. ### Describe the solution you'd like The best-case scenario would be a server-side auth method that allows us to update the user's private fields (with `input: false`) and automatically updates sessions accordingly. Alternatively, providing a server-side utility like refreshSessions would also work. ### Describe alternatives you've considered Right now, I’m using [refreshUserSession](https://github.com/better-auth/better-auth/blob/5d26a5459501d566154dfbefe72fc82e83c4a0c5/packages/better-auth/src/db/internal-adapter.ts#L54), which is used internally by better-auth. ### Additional context Im also wondering why is [refreshUserSession](https://github.com/better-auth/better-auth/blob/5d26a5459501d566154dfbefe72fc82e83c4a0c5/packages/better-auth/src/db/internal-adapter.ts#L54) is being called twice [here](https://github.com/better-auth/better-auth/blob/5d26a5459501d566154dfbefe72fc82e83c4a0c5/packages/better-auth/src/db/internal-adapter.ts#L809)
GiteaMirror added the core label 2026-04-17 19:14:08 -05:00
GiteaMirror commented 2026-04-17 19:14:09 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Dec 15, 2025):

Hello there! Thanks for raising this. I understand you’d like a way to refresh user sessions when user data (like access rights) is updated, for example, via a webhook. Internally, Better Auth makes use of a refreshUserSession function to update sessions, and it’s indeed called at multiple points to ensure consistency after a user update. We’re evaluating options to expose a dedicated server-side utility (or automatic behavior) so that when a user record is updated, active sessions are refreshed accordingly.

In the meantime, one workaround is to call the existing refreshUserSession utility manually after applying your changes in the backend. This mimics what the built-in mechanism does, though it requires a bit of extra coding. The fact that the function is called twice hints that there may be two separate points in the code path requiring revalidation—which we’re actively reviewing for improvements [1][2].

Could you share more details about your current setup or use case so we can further assist you? Tag @better-auth-agent if you would like an answer from the Agent.

If you need more help, tag @better-auth-agent in a comment so I can respond.

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3655945244 --> @better-auth-agent[bot] commented on GitHub (Dec 15, 2025): Hello there! Thanks for raising this. I understand you’d like a way to refresh user sessions when user data (like access rights) is updated, for example, via a webhook. Internally, Better Auth makes use of a refreshUserSession function to update sessions, and it’s indeed called at multiple points to ensure consistency after a user update. We’re evaluating options to expose a dedicated server-side utility (or automatic behavior) so that when a user record is updated, active sessions are refreshed accordingly. In the meantime, one workaround is to call the existing refreshUserSession utility manually after applying your changes in the backend. This mimics what the built-in mechanism does, though it requires a bit of extra coding. The fact that the function is called twice hints that there may be two separate points in the code path requiring revalidation—which we’re actively reviewing for improvements [[1]](https://github.com/better-auth/better-auth/issues/1183)[[2]](https://github.com/better-auth/better-auth/issues/4250). Could you share more details about your current setup or use case so we can further assist you? Tag @better-auth-agent if you would like an answer from the Agent. _If you need more help, tag @better-auth-agent in a comment so I can respond._ <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) • [Discord](https://discord.gg/fG2XXEuQX3) • [GitHub](https://github.com/Skyvern-AI/Skyvern) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/fG2XXEuQX3) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/Skyvern-AI/Skyvern)
GiteaMirror commented 2026-04-17 19:14:09 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Mar 16, 2026):

Hi, @pauksztello. I'm Dosu, and I'm helping the better-auth team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You requested a feature to refresh user sessions when user access changes, noting no exposed API currently exists.
  • You use an internal method, refreshUserSession, and asked why it is called twice in the code.
  • The maintainer explained the double call ensures consistency and plans to expose a dedicated server-side utility or automatic session refresh in the future.
  • Meanwhile, the suggested workaround is to manually call refreshUserSession after backend changes.
  • The maintainer also requested more details about your setup to assist further.

Next Steps:

  • Please let me know if this issue is still relevant with the latest version of better-auth by commenting here to keep the discussion open.
  • Otherwise, this issue will be automatically closed in 7 days.

Thanks for your understanding and contribution!

<!-- gh-comment-id:4068841021 --> @dosubot[bot] commented on GitHub (Mar 16, 2026): Hi, @pauksztello. I'm [Dosu](https://dosu.dev), and I'm helping the better-auth team manage their backlog and am marking this issue as stale. **Issue Summary:** - You requested a feature to refresh user sessions when user access changes, noting no exposed API currently exists. - You use an internal method, refreshUserSession, and asked why it is called twice in the code. - The maintainer explained the double call ensures consistency and plans to expose a dedicated server-side utility or automatic session refresh in the future. - Meanwhile, the suggested workaround is to manually call refreshUserSession after backend changes. - The maintainer also requested more details about your setup to assist further. **Next Steps:** - Please let me know if this issue is still relevant with the latest version of better-auth by commenting here to keep the discussion open. - Otherwise, this issue will be automatically closed in 7 days. Thanks for your understanding and contribution!
GiteaMirror commented 2026-04-17 19:14:10 -05:00
Author
Owner
Copy Link

@pauksztello commented on GitHub (Mar 20, 2026):

S

Hi, @pauksztello. I'm Dosu, and I'm helping the better-auth team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You requested a feature to refresh user sessions when user access changes, noting no exposed API currently exists.
  • You use an internal method, refreshUserSession, and asked why it is called twice in the code.
  • The maintainer explained the double call ensures consistency and plans to expose a dedicated server-side utility or automatic session refresh in the future.
  • Meanwhile, the suggested workaround is to manually call refreshUserSession after backend changes.
  • The maintainer also requested more details about your setup to assist further.

Next Steps:

  • Please let me know if this issue is still relevant with the latest version of better-auth by commenting here to keep the discussion open.
  • Otherwise, this issue will be automatically closed in 7 days.

Thanks for your understanding and contribution!

Still no solution

<!-- gh-comment-id:4096319322 --> @pauksztello commented on GitHub (Mar 20, 2026): S > Hi, [@pauksztello](https://github.com/pauksztello). I'm [Dosu](https://dosu.dev), and I'm helping the better-auth team manage their backlog and am marking this issue as stale. > > **Issue Summary:** > > * You requested a feature to refresh user sessions when user access changes, noting no exposed API currently exists. > * You use an internal method, refreshUserSession, and asked why it is called twice in the code. > * The maintainer explained the double call ensures consistency and plans to expose a dedicated server-side utility or automatic session refresh in the future. > * Meanwhile, the suggested workaround is to manually call refreshUserSession after backend changes. > * The maintainer also requested more details about your setup to assist further. > > **Next Steps:** > > * Please let me know if this issue is still relevant with the latest version of better-auth by commenting here to keep the discussion open. > * Otherwise, this issue will be automatically closed in 7 days. > > Thanks for your understanding and contribution! Still no solution
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label core
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#27948
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?