github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #5470] [MERGED] feat: add storeStateStrategy #31624

New Issue
Closed
opened 2026-04-17 22:31:04 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-17 22:31:04 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/5470
Author: @himself65
Created: 10/21/2025
Status: ✅ Merged
Merged: 10/22/2025
Merged by: @himself65

Base: canary ← Head: himself65/2025/10/21/store-cookie

📝 Commits (6)

📊 Changes

6 files changed (+231 additions, -60 deletions)

View changed files

📝 packages/better-auth/src/__snapshots__/init.test.ts.snap (+4 -0)
📝 packages/better-auth/src/init.ts (+6 -0)
📝 packages/better-auth/src/oauth2/state.ts (+132 -59)
📝 packages/better-auth/src/plugins/generic-oauth/generic-oauth.test.ts (+70 -0)
📝 packages/core/src/types/context.ts (+10 -1)
📝 packages/core/src/types/init-options.ts (+9 -0)

📄 Description

Summary by cubic

Adds a configurable OAuth state storage strategy with a new storeStateStrategy option. Default is an encrypted cookie (“cookie”) for stateless flows, with “database” as a fallback.

  • New Features

    • Added advanced.oauthConfig.storeStateStrategy: "cookie" (default) or "database".
    • Encrypted cookie storage for OAuth state using the app secret; cookie name: oauth_state; TTL: 10 minutes.
    • Database strategy retained with signed state cookie check and verification cleanup.
    • parseState clears cookies after use and validates expiration.
    • skipStateCookieCheck remains available (dangerous; for dev/staging).
    • Updated types and init wiring to expose oauthConfig in context and options.

  • Migration

    • If you rely on database-backed state, set advanced.oauthConfig.storeStateStrategy = "database".
    • Ensure a stable secret is configured for cookie encryption.
    • Note the cookie-based flow uses oauth_state and a 10-minute TTL.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/5470 **Author:** [@himself65](https://github.com/himself65) **Created:** 10/21/2025 **Status:** ✅ Merged **Merged:** 10/22/2025 **Merged by:** [@himself65](https://github.com/himself65) **Base:** `canary` ← **Head:** `himself65/2025/10/21/store-cookie` --- ### 📝 Commits (6) - [`cfae751`](https://github.com/better-auth/better-auth/commit/cfae751f6c0c6cddd0e4b1828eb72945f1862d67) feat: add `storeStateStrategy` - [`e597e18`](https://github.com/better-auth/better-auth/commit/e597e18bab5f4dbb029672154fd4cfd5e2eebbcf) Update packages/better-auth/src/oauth2/state.ts - [`d2b799e`](https://github.com/better-auth/better-auth/commit/d2b799e18d32f5232c052022b7eb970a01225bd2) fix: store in db - [`28e8d11`](https://github.com/better-auth/better-auth/commit/28e8d113d8ffe25c59a73cd78961c7227ce89071) fix: use database for now - [`0d09b83`](https://github.com/better-auth/better-auth/commit/0d09b838cd0be141a4efebcd17945a39fd6ade7c) test: fix - [`4f51d10`](https://github.com/better-auth/better-auth/commit/4f51d106d671d7c99fbc83d40a8bd278aefc9952) chore: update snap ### 📊 Changes **6 files changed** (+231 additions, -60 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/__snapshots__/init.test.ts.snap` (+4 -0) 📝 `packages/better-auth/src/init.ts` (+6 -0) 📝 `packages/better-auth/src/oauth2/state.ts` (+132 -59) 📝 `packages/better-auth/src/plugins/generic-oauth/generic-oauth.test.ts` (+70 -0) 📝 `packages/core/src/types/context.ts` (+10 -1) 📝 `packages/core/src/types/init-options.ts` (+9 -0) </details> ### 📄 Description <!-- This is an auto-generated description by cubic. --> ## Summary by cubic Adds a configurable OAuth state storage strategy with a new storeStateStrategy option. Default is an encrypted cookie (“cookie”) for stateless flows, with “database” as a fallback. - **New Features** - Added advanced.oauthConfig.storeStateStrategy: "cookie" (default) or "database". - Encrypted cookie storage for OAuth state using the app secret; cookie name: oauth_state; TTL: 10 minutes. - Database strategy retained with signed state cookie check and verification cleanup. - parseState clears cookies after use and validates expiration. - skipStateCookieCheck remains available (dangerous; for dev/staging). - Updated types and init wiring to expose oauthConfig in context and options. - **Migration** - If you rely on database-backed state, set advanced.oauthConfig.storeStateStrategy = "database". - Ensure a stable secret is configured for cookie encryption. - Note the cookie-based flow uses oauth_state and a 10-minute TTL. <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-17 22:31:04 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#31624
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?