github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #9177] tracking: session cookie cache (lifecycle, cleanup, set-cookie propagation) #28618

New Issue
Open
opened 2026-04-17 20:03:11 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-17 20:03:11 -05:00
Owner
Copy Link

Originally created by @gustavovalverde on GitHub (Apr 14, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/9177

Summary

Cookie-cache reads and writes are not consistently propagated, invalidated, or synchronized with the source of truth. The open sub-issues describe expiry overwrite, refresh discard, prefix mismatch, dropped set-cookie headers, incomplete cleanup, stale lookups, oversized payloads, and framework integrations that expose the same write-path gap.

Root cause

Several parts of the cookie-cache lifecycle fail independently. getSessionFromCtx can discard an inner set-cookie header when returnHeaders: false is used. APIError can clear a pending delete-cookie header. Cookie prefix derivation differs between getCookieCache and createCookieGetter. signOut does not always clear session_data, and account_data does not always cascade on expiry. Stateless refresh can override newExpiresAt, while listSessions can ignore freshAge. The twoFactor plugin also relies on cookie cache for pending state, so expiry in session_data can log the user out. Oversized user objects exceed cookie limits, and framework adapters can fail to emit or retain session_token.

Scope

In: cookie cache lifecycle, set-cookie propagation across handlers, invalidation semantics on sign-out and expiry, oversized-payload handling, framework-adapter cookie emission (Next.js RSC, TanStack Start).

Out: OAuth state cookie writes (OAuth state_mismatch cluster). Stateless getAccessToken refresh (tracking: stateless sessions). Request-context origin derivation (tracking: origin/CORS).

Resolution criteria

  • getSessionFromCtx always forwards inner set-cookie headers.
  • signOut clears session_data alongside session_token.
  • account_data invalidation cascades to dependent cookies.
  • Cookie prefix is derived consistently on read and write.
  • APIError preserves the intended delete-cookie header.
  • listSessions respects freshAge.
  • twoFactor remains usable after session_data expiry, without relying on cookie cache as a state store.
  • Oversized cookies chunk or shed non-essential fields.
  • Secondary-storage TTL does not force re-login inside the cookie-cache window.
  • Next.js server components and TanStack Start emit and read session_token correctly.

Related

  • One duplicate was already closed against the canonical twoFactor expiry report. Keep the canonical report open.
  • Likely upstream of stateless refresh failures in tracking: stateless sessions (#8562, #7703).
  • Prior closed context: #8819, #7454 (secondary-storage id stripping), #8156 (expiresAt type bug).
Originally created by @gustavovalverde on GitHub (Apr 14, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/9177 ## Summary Cookie-cache reads and writes are not consistently propagated, invalidated, or synchronized with the source of truth. The open sub-issues describe expiry overwrite, refresh discard, prefix mismatch, dropped `set-cookie` headers, incomplete cleanup, stale lookups, oversized payloads, and framework integrations that expose the same write-path gap. ## Root cause Several parts of the cookie-cache lifecycle fail independently. `getSessionFromCtx` can discard an inner `set-cookie` header when `returnHeaders: false` is used. `APIError` can clear a pending delete-cookie header. Cookie prefix derivation differs between `getCookieCache` and `createCookieGetter`. `signOut` does not always clear `session_data`, and `account_data` does not always cascade on expiry. Stateless refresh can override `newExpiresAt`, while `listSessions` can ignore `freshAge`. The twoFactor plugin also relies on cookie cache for pending state, so expiry in `session_data` can log the user out. Oversized user objects exceed cookie limits, and framework adapters can fail to emit or retain `session_token`. ## Scope **In:** cookie cache lifecycle, set-cookie propagation across handlers, invalidation semantics on sign-out and expiry, oversized-payload handling, framework-adapter cookie emission (Next.js RSC, TanStack Start). **Out:** OAuth state cookie writes (OAuth state_mismatch cluster). Stateless `getAccessToken` refresh (`tracking: stateless sessions`). Request-context origin derivation (`tracking: origin/CORS`). ## Resolution criteria - `getSessionFromCtx` always forwards inner `set-cookie` headers. - `signOut` clears `session_data` alongside `session_token`. - `account_data` invalidation cascades to dependent cookies. - Cookie prefix is derived consistently on read and write. - `APIError` preserves the intended delete-cookie header. - `listSessions` respects `freshAge`. - twoFactor remains usable after `session_data` expiry, without relying on cookie cache as a state store. - Oversized cookies chunk or shed non-essential fields. - Secondary-storage TTL does not force re-login inside the cookie-cache window. - Next.js server components and TanStack Start emit and read `session_token` correctly. ## Related - One duplicate was already closed against the canonical twoFactor expiry report. Keep the canonical report open. - Likely upstream of stateless refresh failures in `tracking: stateless sessions` (#8562, #7703). - Prior closed context: #8819, #7454 (secondary-storage `id` stripping), #8156 (expiresAt type bug).
GiteaMirror added the trackingcorebug labels 2026-04-17 20:03:11 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug core tracking
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#28618
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?