github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 08:01:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #8191] Id_token not included in getAccessToken returning stale data #28343

New Issue
Closed
opened 2026-04-17 19:45:51 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-04-17 19:45:51 -05:00
Owner
Copy Link

Originally created by @tstysial on GitHub (Feb 27, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/8191

You're absolutely right - this is a confirmed bug! Looking at the code:

In getAccessToken, the updatedData object only includes 4 fields when auto-refreshing:

const updatedData = {
    accessToken: await setTokenUtil(newTokens.accessToken, ctx.context),
    accessTokenExpiresAt: newTokens.accessTokenExpiresAt,
    refreshToken: await setTokenUtil(newTokens.refreshToken, ctx.context),
    refreshTokenExpiresAt: newTokens.refreshTokenExpiresAt,
    // idToken is missing here!
};

Meanwhile, refreshToken correctly includes it:

idToken: tokens.idToken || account.idToken

Interestingly, getAccessToken does return the idToken in its API response, but it never persists it to the database or account cookie.

Your proposed fix is correct - adding idToken: newTokens.idToken || account.idToken to the updatedData object should resolve this. This looks like an oversight when the auto-refresh feature was added to getAccessToken. I'd recommend opening a bug issue (or converting this discussion to one) so it gets tracked and fixed.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

Originally posted by @dosubot in https://github.com/better-auth/better-auth/discussions/8188#discussioncomment-15949648

Originally created by @tstysial on GitHub (Feb 27, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/8191 <!-- Answer --> You're absolutely right - this is a confirmed bug! Looking at the code: In [`getAccessToken`](https://github.com/better-auth/better-auth/blob/074478e928624ca038a579817b47174ac15ef56a/packages/better-auth/src/api/routes/account.ts#L566-L571), the `updatedData` object only includes 4 fields when auto-refreshing: ```ts const updatedData = { accessToken: await setTokenUtil(newTokens.accessToken, ctx.context), accessTokenExpiresAt: newTokens.accessTokenExpiresAt, refreshToken: await setTokenUtil(newTokens.refreshToken, ctx.context), refreshTokenExpiresAt: newTokens.refreshTokenExpiresAt, // idToken is missing here! }; ``` Meanwhile, [`refreshToken`](https://github.com/better-auth/better-auth/blob/074478e928624ca038a579817b47174ac15ef56a/packages/better-auth/src/api/routes/account.ts#L759-L768) correctly includes it: ```ts idToken: tokens.idToken || account.idToken ``` Interestingly, `getAccessToken` does return the `idToken` in its [API response](https://github.com/better-auth/better-auth/blob/074478e928624ca038a579817b47174ac15ef56a/packages/better-auth/src/api/routes/account.ts#L603-L611), but it never persists it to the database or account cookie. Your proposed fix is correct - adding `idToken: newTokens.idToken || account.idToken` to the `updatedData` object should resolve this. This looks like an oversight when the auto-refresh feature was added to `getAccessToken`. I'd recommend opening a bug issue (or converting this discussion to one) so it gets tracked and fixed. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/98a6852c-4809-4278-a4f8-431de3b84ce1?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/98a6852c-4809-4278-a4f8-431de3b84ce1?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/98a6852c-4809-4278-a4f8-431de3b84ce1?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/98a6852c-4809-4278-a4f8-431de3b84ce1?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/98a6852c-4809-4278-a4f8-431de3b84ce1?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/98a6852c-4809-4278-a4f8-431de3b84ce1?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/98a6852c-4809-4278-a4f8-431de3b84ce1?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=You%27re%20absolutely%20right%20-%20this%20is%20a%20confirmed%20bug%21%20Looking%20at%20the%20code%3A%0A%0AIn%20%5B%60getAccessToken%60%5D%28https%3A//github.com/better-auth/better-auth/blob/074478e928624ca038a579817b47174ac15ef56a/packages/better-auth/src/api/routes/account.ts%23L566-L571%29%2C%20the%20%60updatedData%60%20object%20only%20includes%204%20fields%20when%20auto-refreshing%3A%0A%60%60%60ts%0Aconst%20updatedData%20%3D%20%7B%0A%20%20%20%20accessToken%3A%20await%20setTokenUtil%28newTokens.accessToken%2C%20ctx.context%29%2C%0A%20%20%20%20accessTokenExpiresAt%3A%20newTokens.accessTokenExpiresAt%2C%0A%20%20%20%20refreshToken%3A%20await%20setTokenUtil%28newTokens.refreshToken%2C%20ctx.context%29%2C%0A%20%20%20%20refreshTokenExpiresAt%3A%20newTokens.refreshTokenExpiresAt%2C%0A%20%20%20%20//%20idToken%20is%20missing%20here%21%0A%7D%3B%0A%60%60%60%0A%0AMeanwhile%2C%20%5B%60refreshToken%60%5D%28https%3A//github.com/better-auth/better-auth/blob/074478e928624ca038a579817b47174ac15ef56a/packages/better-auth/src/api/routes/account.ts%23L759-L768%29%20correctly%20includes%20it%3A%0A%60%60%60ts%0AidToken%3A%20tokens.idToken%20%7C%7C%20account.idToken%0A%60%60%60%0A%0AInterestingly%2C%20%60getAccessToken%60%20does%20return%20the%20%60idToken%60%20in%20its%20%5BAPI%20response%5D%28https%3A//github.com/better-auth/better-auth/blob/074478e928624ca038a579817b47174ac15ef56a/packages/better-auth/src/api/routes/account.ts%23L603-L611%29%2C%20but%20it%20never%20persists%20it%20to%20the%20database%20or%20account%20cookie.%0A%0AYour%20proposed%20fix%20is%20correct%20-%20adding%20%60idToken%3A%20newTokens.idToken%20%7C%7C%20account.idToken%60%20to%20the%20%60updatedData%60%20object%20should%20resolve%20this.%20This%20looks%20like%20an%20oversight%20when%20the%20auto-refresh%20feature%20was%20added%20to%20%60getAccessToken%60.%20I%27d%20recommend%20opening%20a%20bug%20issue%20%28or%20converting%20this%20discussion%20to%20one%29%20so%20it%20gets%20tracked%20and%20fixed.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/discussions/8188) _Originally posted by @dosubot in https://github.com/better-auth/better-auth/discussions/8188#discussioncomment-15949648_
GiteaMirror added the lockedbug labels 2026-04-17 19:45:51 -05:00
GiteaMirror commented 2026-04-17 19:45:54 -05:00
Author
Owner
Copy Link

@GautamBytes commented on GitHub (Feb 28, 2026):

Looking into it!

<!-- gh-comment-id:3976416779 --> @GautamBytes commented on GitHub (Feb 28, 2026): Looking into it!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#28343
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?