github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #6944] Better-Auth 1.4.8 broken and unusable due to trusted origins #28003

New Issue
Closed
opened 2026-04-17 19:19:53 -05:00 by GiteaMirror · 8 comments
GiteaMirror commented 2026-04-17 19:19:53 -05:00
Owner
Copy Link

Originally created by @JE4GLE on GitHub (Dec 23, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/6944

To Reproduce

  1. Create backend using Svelte and configure better-auth with trustedOrigins on localhost
  2. Try to signup or do any action with better-auth

Current behavior

error Invalid origin: http://localhost:5173 []
info If it's a valid URL, please add http://localhost:5173 to trustedOrigins in your auth config
 [
  'Current list of trustedOrigins: http://localhost:5173,http://localhost:5173,http://localhost:5174,http://192.168.178.71:5173,http://192.168.178.71:5174'
]

Expected behavior

No error, the requests work.

What version of Better Auth are you using?

1.4.8

System info

The command npx @better-auth/cli info --json produces no output and results in exit code 1.

Which area(s) are affected? (Select all that apply)

Backend, every auth action

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  trustedOrigins: [
    'http://localhost:5173',
    'http://localhost:5174',
    'http://192.168.178.71:5173',
    'http://192.168.178.71:5174'
  ],
  emailAndPassword: {  
    enabled: true
  },
});

Additional context

It didn't work in 1.4.7 or 1.4.6 either.

Originally created by @JE4GLE on GitHub (Dec 23, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/6944 ### To Reproduce 1. Create backend using Svelte and configure better-auth with trustedOrigins on localhost 2. Try to signup or do any action with better-auth ### Current behavior ``` error Invalid origin: http://localhost:5173 [] info If it's a valid URL, please add http://localhost:5173 to trustedOrigins in your auth config [ 'Current list of trustedOrigins: http://localhost:5173,http://localhost:5173,http://localhost:5174,http://192.168.178.71:5173,http://192.168.178.71:5174' ] ``` ### Expected behavior No error, the requests work. ### What version of Better Auth are you using? 1.4.8 ### System info The command `npx @better-auth/cli info --json` produces no output and results in exit code 1. ### Which area(s) are affected? (Select all that apply) Backend, every auth action ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ trustedOrigins: [ 'http://localhost:5173', 'http://localhost:5174', 'http://192.168.178.71:5173', 'http://192.168.178.71:5174' ], emailAndPassword: { enabled: true }, }); ``` ### Additional context It didn't work in 1.4.7 or 1.4.6 either.
GiteaMirror added the lockedbug labels 2026-04-17 19:19:53 -05:00
GiteaMirror commented 2026-04-17 19:19:55 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Dec 23, 2025):

It seems you are facing an "Invalid origin" error while using Better Auth version 1.4.8. This issue usually arises when the origin from which you're making requests isn't included in the trustedOrigins array of your auth config.

To resolve this issue, please check the following steps:

  1. Verify trustedOrigins Configuration: Ensure that you have correctly added http://localhost:5173 and any other origins you plan to access in the trustedOrigins array. Here’s an example:

    export const auth = betterAuth({
  trustedOrigins: [
    'http://localhost:5173',
    'http://localhost:5174',
    'http://192.168.178.71:5173',
    'http://192.168.178.71:5174'
  ],
  emailAndPassword: {  
    enabled: true
  },
});

  2. Check Base URL Configuration: Ensure you have defined the baseURL correctly. If baseURL is inferred from the first request, your origins should be evaluated accordingly [11].

  3. Environment Variable: Make sure that if you are using an environment variable for trusted origins (e.g. BETTER_AUTH_TRUSTED_ORIGINS), it is set correctly in your environment [7].

If you follow these steps and the error persists, please consider tagging the Better Auth team members Beka and Max (@bekacru and @ping__) for further assistance.

What other questions do you have regarding Better Auth configurations?

If you need more help, tag @better-auth-agent in a comment so I can respond.

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3685644079 --> @better-auth-agent[bot] commented on GitHub (Dec 23, 2025): It seems you are facing an "Invalid origin" error while using Better Auth version 1.4.8. This issue usually arises when the origin from which you're making requests isn't included in the `trustedOrigins` array of your auth config. To resolve this issue, please check the following steps: 1. **Verify `trustedOrigins` Configuration**: Ensure that you have correctly added `http://localhost:5173` and any other origins you plan to access in the `trustedOrigins` array. Here’s an example: ```typescript export const auth = betterAuth({ trustedOrigins: [ 'http://localhost:5173', 'http://localhost:5174', 'http://192.168.178.71:5173', 'http://192.168.178.71:5174' ], emailAndPassword: { enabled: true }, }); ``` 2. **Check Base URL Configuration**: Ensure you have defined the `baseURL` correctly. If `baseURL` is inferred from the first request, your origins should be evaluated accordingly [[11]](https://github.com/better-auth/better-auth/pull/6882). 3. **Environment Variable**: Make sure that if you are using an environment variable for trusted origins (e.g. `BETTER_AUTH_TRUSTED_ORIGINS`), it is set correctly in your environment [[7]](https://github.com/better-auth/better-auth/pull/6809). If you follow these steps and the error persists, please consider tagging the Better Auth team members Beka and Max (@bekacru and @ping__) for further assistance. What other questions do you have regarding Better Auth configurations? _If you need more help, tag @better-auth-agent in a comment so I can respond._ <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) • [Discord](https://discord.gg/fG2XXEuQX3) • [GitHub](https://github.com/Skyvern-AI/Skyvern) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/fG2XXEuQX3) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/Skyvern-AI/Skyvern)
GiteaMirror commented 2026-04-17 19:19:56 -05:00
Author
Owner
Copy Link

@JE4GLE commented on GitHub (Dec 23, 2025):

@better-auth-agent @Bekacru @ping-maxwell The suggested solution by the agent is not helping. You can see in the error message by Better-Auth that the correct URL is configured. I would say, the validation logic is incorrect.

info If it's a valid URL, please add http://localhost:5173 to trustedOrigins in your auth config
 [
  'Current list of trustedOrigins: http://localhost:5173,http://localhost:5173,http://localhost:5174,http://192.168.178.71:5173,http://192.168.178.71:5174'
]
<!-- gh-comment-id:3685658611 --> @JE4GLE commented on GitHub (Dec 23, 2025): @better-auth-agent @Bekacru @ping-maxwell The suggested solution by the agent is not helping. You can see in the error message by Better-Auth that the correct URL is configured. I would say, the validation logic is incorrect. ``` info If it's a valid URL, please add http://localhost:5173 to trustedOrigins in your auth config [ 'Current list of trustedOrigins: http://localhost:5173,http://localhost:5173,http://localhost:5174,http://192.168.178.71:5173,http://192.168.178.71:5174' ] ```
GiteaMirror commented 2026-04-17 19:19:58 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Dec 23, 2025):

It seems that the error you're encountering, indicating an "Invalid origin" for http://localhost:5173, may stem from a few possible issues with your trustedOrigins configuration.

Here are steps you can follow to troubleshoot this problem:

  1. Check for Duplicates: Ensure that http://localhost:5173 is not somehow duplicated in your configuration. The error message suggests it appears twice in the list of trustedOrigins.

  2. Wildcard Support: Verify that you’re using a proper format. The trustedOrigins list can support wildcards. If you're still facing issues, consider using more flexible patterns that might cover the origins you need, such as http://localhost:* which would allow all ports on localhost.

  3. Base URL Inference: There's a fix in place that addresses issues related to base URL inference and trusted origins, which might have affected your setup. If you have any specific configurations that infer base URLs, make sure they are correctly set up to match your trusted origins [6].

  4. Version Check: Since you’re using version 1.4.8, ensure there aren’t any outstanding issues or updates from the repository that could resolve related errors.

If these steps don’t resolve your issue, it might be helpful to tag Beka and Max at @bekacru and @ping__ for further assistance.

What specific configurations are you using with trustedOrigins, and have you considered implementing wildcard patterns to simplify your setup?

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3685659832 --> @better-auth-agent[bot] commented on GitHub (Dec 23, 2025): It seems that the error you're encountering, indicating an "Invalid origin" for `http://localhost:5173`, may stem from a few possible issues with your trustedOrigins configuration. Here are steps you can follow to troubleshoot this problem: 1. **Check for Duplicates:** Ensure that `http://localhost:5173` is not somehow duplicated in your configuration. The error message suggests it appears twice in the list of trustedOrigins. 2. **Wildcard Support:** Verify that you’re using a proper format. The trustedOrigins list can support wildcards. If you're still facing issues, consider using more flexible patterns that might cover the origins you need, such as `http://localhost:*` which would allow all ports on localhost. 3. **Base URL Inference:** There's a fix in place that addresses issues related to base URL inference and trusted origins, which might have affected your setup. If you have any specific configurations that infer base URLs, make sure they are correctly set up to match your trusted origins [[6]](https://github.com/better-auth/better-auth/pull/6904). 4. **Version Check:** Since you’re using version 1.4.8, ensure there aren’t any outstanding issues or updates from the repository that could resolve related errors. If these steps don’t resolve your issue, it might be helpful to tag Beka and Max at @bekacru and @ping__ for further assistance. What specific configurations are you using with trustedOrigins, and have you considered implementing wildcard patterns to simplify your setup? <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) • [Discord](https://discord.gg/fG2XXEuQX3) • [GitHub](https://github.com/Skyvern-AI/Skyvern) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/fG2XXEuQX3) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/Skyvern-AI/Skyvern)
GiteaMirror commented 2026-04-17 19:19:58 -05:00
Author
Owner
Copy Link

@Bekacru commented on GitHub (Dec 23, 2025):

I can't repoduce this issue on my end.

can you make a minimal repro?

<!-- gh-comment-id:3685793155 --> @Bekacru commented on GitHub (Dec 23, 2025): I can't repoduce this issue on my end. can you make a minimal repro?
GiteaMirror commented 2026-04-17 19:19:59 -05:00
Author
Owner
Copy Link

@bytaesu commented on GitHub (Dec 23, 2025):

Hi @JE4GLE,

I couldn't reproduce the issue with this setup. Could you share reproducible code or a repo?

import { getRequestEvent } from "$app/server";
import { betterAuth } from "better-auth";
import { sveltekitCookies } from "better-auth/svelte-kit";
import { Pool } from "pg";
import { DATABASE_URL } from "$env/static/private";

export const auth = betterAuth({
  database: new Pool({
    connectionString: DATABASE_URL,
  }),
    trustedOrigins: [
    'http://localhost:5173',
    'http://localhost:5174',
    'http://192.168.178.71:5173',
    'http://192.168.178.71:5174'
  ],
  emailAndPassword: { 
    enabled: true, 
  }, 
  plugins: [sveltekitCookies(getRequestEvent)],
});

https://github.com/user-attachments/assets/651f2c81-dcec-4a8f-950a-c8d3c9468229

<!-- gh-comment-id:3685991043 --> @bytaesu commented on GitHub (Dec 23, 2025): Hi @JE4GLE, I couldn't reproduce the issue with this setup. Could you share reproducible code or a repo? ```ts import { getRequestEvent } from "$app/server"; import { betterAuth } from "better-auth"; import { sveltekitCookies } from "better-auth/svelte-kit"; import { Pool } from "pg"; import { DATABASE_URL } from "$env/static/private"; export const auth = betterAuth({ database: new Pool({ connectionString: DATABASE_URL, }), trustedOrigins: [ 'http://localhost:5173', 'http://localhost:5174', 'http://192.168.178.71:5173', 'http://192.168.178.71:5174' ], emailAndPassword: { enabled: true, }, plugins: [sveltekitCookies(getRequestEvent)], }); ``` https://github.com/user-attachments/assets/651f2c81-dcec-4a8f-950a-c8d3c9468229
GiteaMirror commented 2026-04-17 19:20:00 -05:00
Author
Owner
Copy Link

@bytaesu commented on GitHub (Dec 23, 2025):

@JE4GLE

SvelteKit is indeed a full-stack framework, but it's unclear what you mean by “backend using Svelte” Could you explain how you've set it up? That would help me investigate and resolve your issue 😁

<!-- gh-comment-id:3686016658 --> @bytaesu commented on GitHub (Dec 23, 2025): @JE4GLE SvelteKit is indeed a full-stack framework, but it's unclear what you mean by “backend using Svelte” Could you explain how you've set it up? That would help me investigate and resolve your issue 😁
GiteaMirror commented 2026-04-17 19:20:01 -05:00
Author
Owner
Copy Link

@JE4GLE commented on GitHub (Dec 23, 2025):

@Bekacru @bytaesu I did some further research and found the error was due to the function getTrustedOrigins(options). It returned an empty array []. The mjs file compiled to the following:

function getTrustedOrigins(options) {
	const baseURL = getBaseURL(options.baseURL, options.basePath);
	if (!baseURL) return [];
	const trustedOrigins = [new URL(baseURL).origin];
	if (options.trustedOrigins && Array.isArray(options.trustedOrigins)) trustedOrigins.push(...options.trustedOrigins);
	const envTrustedOrigins = env.BETTER_AUTH_TRUSTED_ORIGINS;
	if (envTrustedOrigins) trustedOrigins.push(...envTrustedOrigins.split(","));
	if (trustedOrigins.filter((x) => !x).length) throw new BetterAuthError("A provided trusted origin is invalid, make sure your trusted origins list is properly defined.");
	return trustedOrigins;
}

After setting the baseURL, it worked again, but the issue seems to have been introduced in the last few updates as this issue never occurred before.

<!-- gh-comment-id:3686298358 --> @JE4GLE commented on GitHub (Dec 23, 2025): @Bekacru @bytaesu I did some further research and found the error was due to the function `getTrustedOrigins(options)`. It returned an empty array `[]`. The `mjs` file compiled to the following: ```typescript function getTrustedOrigins(options) { const baseURL = getBaseURL(options.baseURL, options.basePath); if (!baseURL) return []; const trustedOrigins = [new URL(baseURL).origin]; if (options.trustedOrigins && Array.isArray(options.trustedOrigins)) trustedOrigins.push(...options.trustedOrigins); const envTrustedOrigins = env.BETTER_AUTH_TRUSTED_ORIGINS; if (envTrustedOrigins) trustedOrigins.push(...envTrustedOrigins.split(",")); if (trustedOrigins.filter((x) => !x).length) throw new BetterAuthError("A provided trusted origin is invalid, make sure your trusted origins list is properly defined."); return trustedOrigins; } ``` After setting the baseURL, it worked again, but the issue seems to have been introduced in the last few updates as this issue never occurred before.
GiteaMirror commented 2026-04-17 19:20:02 -05:00
Author
Owner
Copy Link

@himself65 commented on GitHub (Dec 23, 2025):

Fixed in 1.4.9. It's a release issue. We're gonna improve the release process to avoid such dumb issue

<!-- gh-comment-id:3687097819 --> @himself65 commented on GitHub (Dec 23, 2025): Fixed in 1.4.9. It's a release issue. We're gonna improve the release process to avoid such dumb issue
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#28003
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?