github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #8638] stateless defaults don't match the docs #28472

New Issue
Closed
opened 2026-04-17 19:55:01 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-17 19:55:01 -05:00
Owner
Copy Link

Originally created by @s-h-a-d-o-w on GitHub (Mar 16, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/8638

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

  1. Run any project that uses stateless auth.
  2. Rely on defaults as described here.
  3. See whether you get logged out after 5 minutes already.

Current vs. Expected behavior

Current

I get logged out after 5 minutes already.

Expected

I get logged out after what it says in the docs. (Currently 7 days.)

What version of Better Auth are you using?

1.5.5

System info

{
  "system": {
    "platform": "linux",
    "arch": "x64",
    "version": "#1 SMP PREEMPT_DYNAMIC Thu Jun  5 18:30:46 UTC 2025",
    "release": "6.6.87.2-microsoft-standard-WSL2",
    "cpuCount": 32,
    "cpuModel": "AMD Ryzen 9 9950X 16-Core Processor",
    "totalMemory": "30.19 GB",
    "freeMemory": "20.66 GB"
  },
  "node": {
    "version": "v24.14.0",
    "env": "development"
  },
  "packageManager": {
    "name": "pnpm",
    "version": "10.31.0"
  },
  "frameworks": [
    {
      "name": "next",
      "version": "^16.1.6"
    },
    {
      "name": "react",
      "version": "^19.2.4"
    }
  ],
  "databases": null,
  "betterAuth": {
    "version": "^1.5.5",
    "config": {
      "baseURL": "[REDACTED]/api/auth",
      "secret": "[REDACTED]",
      "socialProviders": {
        "github": {
          "clientId": "[REDACTED]",
          "clientSecret": "[REDACTED]"
        }
      }
    }
  }
}

Which area(s) are affected? (Select all that apply)

Client

Auth config (if applicable)

See above

Additional context

Docs say: "If you don't provide a database, by default we provide the above configuration for you."

Originally created by @s-h-a-d-o-w on GitHub (Mar 16, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/8638 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce 1. Run any project that uses stateless auth. 2. Rely on defaults as described [here](https://better-auth.com/docs/concepts/session-management#basic-stateless-setup). 3. See whether you get logged out after 5 minutes already. ### Current vs. Expected behavior ## Current I get logged out after 5 minutes already. ## Expected I get logged out after what it says in the docs. (Currently 7 days.) ### What version of Better Auth are you using? 1.5.5 ### System info ```bash { "system": { "platform": "linux", "arch": "x64", "version": "#1 SMP PREEMPT_DYNAMIC Thu Jun 5 18:30:46 UTC 2025", "release": "6.6.87.2-microsoft-standard-WSL2", "cpuCount": 32, "cpuModel": "AMD Ryzen 9 9950X 16-Core Processor", "totalMemory": "30.19 GB", "freeMemory": "20.66 GB" }, "node": { "version": "v24.14.0", "env": "development" }, "packageManager": { "name": "pnpm", "version": "10.31.0" }, "frameworks": [ { "name": "next", "version": "^16.1.6" }, { "name": "react", "version": "^19.2.4" } ], "databases": null, "betterAuth": { "version": "^1.5.5", "config": { "baseURL": "[REDACTED]/api/auth", "secret": "[REDACTED]", "socialProviders": { "github": { "clientId": "[REDACTED]", "clientSecret": "[REDACTED]" } } } } } ``` ### Which area(s) are affected? (Select all that apply) Client ### Auth config (if applicable) ```typescript See above ``` ### Additional context Docs say: "If you don't provide a database, by default we provide the above configuration for you."
GiteaMirror added the lockedbug labels 2026-04-17 19:55:02 -05:00
GiteaMirror commented 2026-04-17 19:55:03 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Mar 16, 2026):

You're right — this is a confirmed documentation vs. code mismatch. The docs show cookieCache.maxAge defaulting to 7 days, but the actual code defaults to 5 minutes:

maxAge: options.session?.cookieCache?.maxAge || 60 * 5,  // 5 minutes, not 7 days

This is also explicitly documented in the TypeScript types as @default 5 minutes (5 * 60).

Workaround: Explicitly set cookieCache.maxAge to match the session expiration:

session: {
  expiresIn: 60 * 60 * 24 * 7, // 7 days
  cookieCache: {
    maxAge: 60 * 60 * 24 * 7, // Must be set explicitly
  }
}

Note: There are additional related issues with stateless sessions, including updateAge not refreshing the session_token cookie properly in stateless mode.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

<!-- gh-comment-id:4069955141 --> @dosubot[bot] commented on GitHub (Mar 16, 2026): <!-- Answer --> You're right — this is a confirmed documentation vs. code mismatch. The docs show `cookieCache.maxAge` defaulting to 7 days, but the [actual code defaults to 5 minutes](https://github.com/better-auth/better-auth/blob/8f47015af223e5db9ff406f6ca8247f6b8dcd9fe/packages/better-auth/src/cookies/index.ts#L117): ```typescript maxAge: options.session?.cookieCache?.maxAge || 60 * 5, // 5 minutes, not 7 days ``` This is also [explicitly documented in the TypeScript types](https://github.com/better-auth/better-auth/blob/8f47015af223e5db9ff406f6ca8247f6b8dcd9fe/packages/core/src/types/init-options.ts#L906) as `@default 5 minutes (5 * 60)`. **Workaround**: Explicitly set `cookieCache.maxAge` to match the session expiration: ```typescript session: { expiresIn: 60 * 60 * 24 * 7, // 7 days cookieCache: { maxAge: 60 * 60 * 24 * 7, // Must be set explicitly } } ``` Note: There are [additional related issues with stateless sessions](https://github.com/better-auth/better-auth/issues/7994), including `updateAge` not refreshing the `session_token` cookie properly in stateless mode. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=brand-link).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/325626fc-e3df-4619-83b4-6187276fd870?feedback_type=great_response&utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/325626fc-e3df-4619-83b4-6187276fd870?feedback_type=irrelevant_answer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/325626fc-e3df-4619-83b4-6187276fd870?feedback_type=incorrect_sources&utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/325626fc-e3df-4619-83b4-6187276fd870?feedback_type=too_verbose&utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/325626fc-e3df-4619-83b4-6187276fd870?feedback_type=hallucination&utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/325626fc-e3df-4619-83b4-6187276fd870?feedback_type=bug_report&utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-bug_report) | [Other](https://app.dosu.dev/response-feedback/325626fc-e3df-4619-83b4-6187276fd870?feedback_type=other&utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=chat-badge)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=You%27re%20right%20%E2%80%94%20this%20is%20a%20confirmed%20documentation%20vs.%20code%20mismatch.%20The%20docs%20show%20%60cookieCache.maxAge%60%20defaulting%20to%207%20days%2C%20but%20the%20%5Bactual%20code%20defaults%20to%205%20minutes%5D%28https%3A//github.com/better-auth/better-auth/blob/8f47015af223e5db9ff406f6ca8247f6b8dcd9fe/packages/better-auth/src/cookies/index.ts%23L117%29%3A%0A%0A%60%60%60typescript%0AmaxAge%3A%20options.session%3F.cookieCache%3F.maxAge%20%7C%7C%2060%20%2A%205%2C%20%20//%205%20minutes%2C%20not%207%20days%0A%60%60%60%0A%0AThis%20is%20also%20%5Bexplicitly%20documented%20in%20the%20TypeScript%20types%5D%28https%3A//github.com/better-auth/better-auth/blob/8f47015af223e5db9ff406f6ca8247f6b8dcd9fe/packages/core/src/types/init-options.ts%23L906%29%20as%20%60%40default%205%20minutes%20%285%20%2A%2060%29%60.%0A%0A%2A%2AWorkaround%2A%2A%3A%20Explicitly%20set%20%60cookieCache.maxAge%60%20to%20match%20the%20session%20expiration%3A%0A%0A%60%60%60typescript%0Asession%3A%20%7B%0A%20%20expiresIn%3A%2060%20%2A%2060%20%2A%2024%20%2A%207%2C%20//%207%20days%0A%20%20cookieCache%3A%20%7B%0A%20%20%20%20maxAge%3A%2060%20%2A%2060%20%2A%2024%20%2A%207%2C%20//%20Must%20be%20set%20explicitly%0A%20%20%7D%0A%7D%0A%60%60%60%0A%0ANote%3A%20There%20are%20%5Badditional%20related%20issues%20with%20stateless%20sessions%5D%28https%3A//github.com/better-auth/better-auth/issues/7994%29%2C%20including%20%60updateAge%60%20not%20refreshing%20the%20%60session_token%60%20cookie%20properly%20in%20stateless%20mode.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=join-discord)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/8638)
GiteaMirror commented 2026-04-17 19:55:04 -05:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Mar 31, 2026):

This issue has been locked as it was closed more than 7 days ago. If you're experiencing a similar problem or you have additional context, please open a new issue and reference this one.

<!-- gh-comment-id:4165911960 --> @github-actions[bot] commented on GitHub (Mar 31, 2026): This issue has been locked as it was closed more than 7 days ago. If you're experiencing a similar problem or you have additional context, please open a new issue and reference this one.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#28472
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?