github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 15:42:09 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #5396] [CLOSED] feat: stateless session management #5979

New Issue
Closed
opened 2026-03-13 12:43:31 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 12:43:31 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/5396
Author: @himself65
Created: 10/17/2025
Status: ❌ Closed

Base: canary ← Head: himself65/2025/10/17/stateless-jwt

📝 Commits (1)

  • ef4af2a feat: stateless session management

📊 Changes

28 files changed (+1618 additions, -28 deletions)

View changed files

➕ demo/minimal/.env.example (+7 -0)
➕ demo/minimal/.gitignore (+36 -0)
➕ demo/minimal/README.md (+107 -0)
➕ demo/minimal/next.config.ts (+7 -0)
➕ demo/minimal/package.json (+25 -0)
➕ demo/minimal/postcss.config.mjs (+5 -0)
➕ demo/minimal/src/app/api/auth/[...all]/route.ts (+4 -0)
➕ demo/minimal/src/app/api/user/route.ts (+27 -0)
➕ demo/minimal/src/app/dashboard/page.tsx (+192 -0)
➕ demo/minimal/src/app/globals.css (+83 -0)
➕ demo/minimal/src/app/layout.tsx (+19 -0)
➕ demo/minimal/src/app/page.tsx (+118 -0)
➕ demo/minimal/src/lib/auth-client.ts (+7 -0)
➕ demo/minimal/src/lib/auth.ts (+25 -0)
➕ demo/minimal/tailwind.config.ts (+57 -0)
➕ demo/minimal/tsconfig.json (+34 -0)
📝 docs/content/docs/concepts/session-management.mdx (+10 -1)
➕ docs/content/docs/guides/stateless-sessions.mdx (+495 -0)
📝 packages/better-auth/src/api/routes/session.ts (+91 -0)
📝 packages/better-auth/src/api/routes/sign-in.ts (+1 -1)

...and 8 more files

📄 Description

Stateless session management, similar to next-auth.

This feature would only work with social provider sign-in. And may not work with many plugins

Things we need to figure out:

  1. How to emit the error when db is required
  2. Ignore some APIs when stateless mode is enabled
  3. A better way to handle the options?

Summary by cubic

Introduce stateless session management via encrypted JWT cookies to remove database dependency for sessions and support social OAuth sign-in. Disables password-based auth and server-side session revocation.

  • New Features

    • Added session.storeSessionInJWT option to enable stateless sessions.
    • Store session+user in encrypted JWE cookies; getSession decodes and checks expiry.
    • Block email/password sign-in and sign-up when stateless mode is on, with clear errors.
    • Disable session revocation endpoints in stateless mode (return BAD_REQUEST).
    • Skip DB writes/reads for user/account/session creation; generate mock IDs in adapter.
    • Bypass cookie cache and secondary storage when using JWT sessions.
    • New JWT helpers (symmetricEncode/Decode, encodeSessionJWT/decodeSessionJWT) with HKDF and jose; includes unit test.

  • Migration

    • Set session.storeSessionInJWT: true.
    • Use social OAuth providers; remove or guard email/password flows.
    • Do not rely on session revocation or secondary storage for session data.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/5396 **Author:** [@himself65](https://github.com/himself65) **Created:** 10/17/2025 **Status:** ❌ Closed **Base:** `canary` ← **Head:** `himself65/2025/10/17/stateless-jwt` --- ### 📝 Commits (1) - [`ef4af2a`](https://github.com/better-auth/better-auth/commit/ef4af2adcb47f775a508848d538901835df28582) feat: stateless session management ### 📊 Changes **28 files changed** (+1618 additions, -28 deletions) <details> <summary>View changed files</summary> ➕ `demo/minimal/.env.example` (+7 -0) ➕ `demo/minimal/.gitignore` (+36 -0) ➕ `demo/minimal/README.md` (+107 -0) ➕ `demo/minimal/next.config.ts` (+7 -0) ➕ `demo/minimal/package.json` (+25 -0) ➕ `demo/minimal/postcss.config.mjs` (+5 -0) ➕ `demo/minimal/src/app/api/auth/[...all]/route.ts` (+4 -0) ➕ `demo/minimal/src/app/api/user/route.ts` (+27 -0) ➕ `demo/minimal/src/app/dashboard/page.tsx` (+192 -0) ➕ `demo/minimal/src/app/globals.css` (+83 -0) ➕ `demo/minimal/src/app/layout.tsx` (+19 -0) ➕ `demo/minimal/src/app/page.tsx` (+118 -0) ➕ `demo/minimal/src/lib/auth-client.ts` (+7 -0) ➕ `demo/minimal/src/lib/auth.ts` (+25 -0) ➕ `demo/minimal/tailwind.config.ts` (+57 -0) ➕ `demo/minimal/tsconfig.json` (+34 -0) 📝 `docs/content/docs/concepts/session-management.mdx` (+10 -1) ➕ `docs/content/docs/guides/stateless-sessions.mdx` (+495 -0) 📝 `packages/better-auth/src/api/routes/session.ts` (+91 -0) 📝 `packages/better-auth/src/api/routes/sign-in.ts` (+1 -1) _...and 8 more files_ </details> ### 📄 Description Stateless session management, similar to next-auth. This feature would only work with social provider sign-in. And may not work with many plugins Things we need to figure out: 1. How to emit the error when db is required 2. Ignore some APIs when stateless mode is enabled 3. A better way to handle the options? <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Introduce stateless session management via encrypted JWT cookies to remove database dependency for sessions and support social OAuth sign-in. Disables password-based auth and server-side session revocation. - **New Features** - Added session.storeSessionInJWT option to enable stateless sessions. - Store session+user in encrypted JWE cookies; getSession decodes and checks expiry. - Block email/password sign-in and sign-up when stateless mode is on, with clear errors. - Disable session revocation endpoints in stateless mode (return BAD_REQUEST). - Skip DB writes/reads for user/account/session creation; generate mock IDs in adapter. - Bypass cookie cache and secondary storage when using JWT sessions. - New JWT helpers (symmetricEncode/Decode, encodeSessionJWT/decodeSessionJWT) with HKDF and jose; includes unit test. - **Migration** - Set session.storeSessionInJWT: true. - Use social OAuth providers; remove or guard email/password flows. - Do not rely on session revocation or secondary storage for session data. <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 12:43:31 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#5979
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?