github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #7462] [CLOSED] chore(docs): clarify access-control-expose-headers management by BA #7329

New Issue
Closed
opened 2026-03-13 13:32:23 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 13:32:23 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/7462
Author: @Diabl0570
Created: 1/19/2026
Status: ❌ Closed

Base: canary ← Head: canary

📄 Description

Problem

When CORS middleware (e.g., Hono's cors) sets the exposeHeaders option, it overrides Better Auth's automatic access-control-expose-headers header management. This breaks functionality for plugins that expose authentication headers:

  • Bearer plugin: set-auth-token
  • JWT plugin: set-auth-jwt
  • One-time-token plugin: set-ott

These plugins read existing access-control-expose-headers and append their headers, but when CORS middleware sets exposeHeaders, it overwrites the header.

Solution

Updated documentation to:

  1. Remove exposeHeaders from the default Hono CORS example
  2. Add CORS configuration warnings to affected plugin docs explaining:
    • Better Auth automatically manages header exposure
    • If using exposeHeaders, users must include Better Auth headers in the list
    • Examples showing proper configuration for Hono and Express

Files Changed

  • docs/content/docs/integrations/hono.mdx - Removed exposeHeaders from example, added warning
  • docs/content/docs/plugins/bearer.mdx - Added CORS configuration section
  • docs/content/docs/plugins/jwt.mdx - Added CORS configuration section
  • docs/content/docs/plugins/one-time-token.mdx - Added CORS configuration section

Summary by cubic

Clarifies that Better Auth manages access-control-expose-headers and how CORS exposeHeaders/exposedHeaders can override it, which can break auth headers. Updates docs: remove exposeHeaders from the Hono CORS example, add CORS callouts with Hono/Express examples in Bearer, JWT, and One-Time Token pages, and document One-Time Token options (setOttHeaderOnNewSession, disableSetSessionCookie).

Written for commit ab7ec8a70b. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/7462 **Author:** [@Diabl0570](https://github.com/Diabl0570) **Created:** 1/19/2026 **Status:** ❌ Closed **Base:** `canary` ← **Head:** `canary` --- ### 📄 Description ### Problem When CORS middleware (e.g., Hono's `cors`) sets the `exposeHeaders` option, it overrides Better Auth's automatic `access-control-expose-headers` header management. This breaks functionality for plugins that expose authentication headers: - **Bearer plugin**: `set-auth-token` - **JWT plugin**: `set-auth-jwt` - **One-time-token plugin**: `set-ott` These plugins read existing `access-control-expose-headers` and append their headers, but when CORS middleware sets `exposeHeaders`, it overwrites the header. ### Solution Updated documentation to: 1. Remove `exposeHeaders` from the default Hono CORS example 2. Add CORS configuration warnings to affected plugin docs explaining: - Better Auth automatically manages header exposure - If using `exposeHeaders`, users must include Better Auth headers in the list - Examples showing proper configuration for Hono and Express ### Files Changed - `docs/content/docs/integrations/hono.mdx` - Removed `exposeHeaders` from example, added warning - `docs/content/docs/plugins/bearer.mdx` - Added CORS configuration section - `docs/content/docs/plugins/jwt.mdx` - Added CORS configuration section - `docs/content/docs/plugins/one-time-token.mdx` - Added CORS configuration section <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Clarifies that Better Auth manages access-control-expose-headers and how CORS exposeHeaders/exposedHeaders can override it, which can break auth headers. Updates docs: remove exposeHeaders from the Hono CORS example, add CORS callouts with Hono/Express examples in Bearer, JWT, and One-Time Token pages, and document One-Time Token options (setOttHeaderOnNewSession, disableSetSessionCookie). <sup>Written for commit ab7ec8a70be7ea3cd61585c2cccaa9dfc8729401. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 13:32:23 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#7329
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?