github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-08-22 16:42:53 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

Updating phone number doesn't return new session cookie in verify response #789

New Issue
Closed
opened 2026-03-13 08:04:23 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-03-13 08:04:23 -05:00
Owner
Copy Link
Copy Source

Originally created by @IronHeartDan on GitHub (Mar 5, 2025).

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

const response = await authClient.phoneNumber.verify({
                phoneNumber: xxx,
                code: yyy,
                updatePhoneNumber: true
            });

This updates the phone number in db but the session is still the cached one.

Current vs. Expected behavior

Current:
No set-cookie is returned to update the session resulting in stale info in front-end

Image

Expected:
set-cookie returned in response which updates the session in front-end
Image

What version of Better Auth are you using?

1.2.3

Provide environment information

- OS: MacOs
- Browser: Chrome

Which area(s) are affected? (Select all that apply)

Backend, Client

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  emailAndPassword: {  
    enabled: true
  },
});

Additional context

The source code simply returns response and doesn't refresh session in header

					if (ctx.body.updatePhoneNumber) {
						const session = await getSessionFromCtx(ctx);
						if (!session) {
							throw new APIError("UNAUTHORIZED", {
								message: BASE_ERROR_CODES.USER_NOT_FOUND,
							});
						}
						let user = await ctx.context.internalAdapter.updateUser(
							session.user.id,
							{
								[opts.phoneNumber]: ctx.body.phoneNumber,
								[opts.phoneNumberVerified]: true,
							},
							ctx,
						);
						return ctx.json({
							status: true,
							token: session.session.token,
							user: {
								id: user.id,
								email: user.email,
								emailVerified: user.emailVerified,
								name: user.name,
								image: user.image,
								phoneNumber: user.phoneNumber,
								phoneNumberVerified: user.phoneNumberVerified,
								createdAt: user.createdAt,
								updatedAt: user.updatedAt,
							} as UserWithPhoneNumber,
						});
					}
Originally created by @IronHeartDan on GitHub (Mar 5, 2025). ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce ``` const response = await authClient.phoneNumber.verify({ phoneNumber: xxx, code: yyy, updatePhoneNumber: true }); ``` This updates the phone number in db but the session is still the cached one. ### Current vs. Expected behavior Current: No set-cookie is returned to update the session resulting in stale info in front-end <img width="860" alt="Image" src="https://github.com/user-attachments/assets/4db9626f-ce2b-4dc5-8fae-3eb3f5fa1689" /> Expected: set-cookie returned in response which updates the session in front-end <img width="863" alt="Image" src="https://github.com/user-attachments/assets/dd3e3c47-7bc0-468d-b8a4-2e39a591d1dd" /> ### What version of Better Auth are you using? 1.2.3 ### Provide environment information ```bash - OS: MacOs - Browser: Chrome ``` ### Which area(s) are affected? (Select all that apply) Backend, Client ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ emailAndPassword: { enabled: true }, }); ``` ### Additional context The source code simply returns response and doesn't refresh session in header ``` if (ctx.body.updatePhoneNumber) { const session = await getSessionFromCtx(ctx); if (!session) { throw new APIError("UNAUTHORIZED", { message: BASE_ERROR_CODES.USER_NOT_FOUND, }); } let user = await ctx.context.internalAdapter.updateUser( session.user.id, { [opts.phoneNumber]: ctx.body.phoneNumber, [opts.phoneNumberVerified]: true, }, ctx, ); return ctx.json({ status: true, token: session.session.token, user: { id: user.id, email: user.email, emailVerified: user.emailVerified, name: user.name, image: user.image, phoneNumber: user.phoneNumber, phoneNumberVerified: user.phoneNumberVerified, createdAt: user.createdAt, updatedAt: user.updatedAt, } as UserWithPhoneNumber, }); } ```
GiteaMirror added the bug label 2026-03-13 08:04:23 -05:00
GiteaMirror commented 2026-03-13 08:04:24 -05:00
Author
Owner
Copy Link
Copy Source

@IronHeartDan commented on GitHub (Mar 5, 2025):

Same thing when:

  • verifying email
  • updating email
@IronHeartDan commented on GitHub (Mar 5, 2025): Same thing when: * verifying email * updating email
GiteaMirror commented 2026-03-13 08:04:24 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Jun 13, 2025):

Hi, @IronHeartDan. I'm Dosu, and I'm helping the better-auth team manage their backlog. I'm marking this issue as stale.

Issue Summary:

  • The issue involves the Better Auth library not returning a new session cookie when updating a phone number or email.
  • This results in stale session information on the front-end, affecting both backend and client areas.
  • The problem is observed in version 1.2.3, with the expected behavior being a set-cookie header in the response to update the session.

Next Steps:

  • Could you please confirm if this issue is still relevant to the latest version of the better-auth repository? If so, feel free to comment to keep the discussion open.
  • If there is no further activity, this issue will be automatically closed in 7 days.

Thank you for your understanding and contribution!

@dosubot[bot] commented on GitHub (Jun 13, 2025): Hi, @IronHeartDan. I'm [Dosu](https://dosu.dev), and I'm helping the better-auth team manage their backlog. I'm marking this issue as stale. **Issue Summary:** - The issue involves the Better Auth library not returning a new session cookie when updating a phone number or email. - This results in stale session information on the front-end, affecting both backend and client areas. - The problem is observed in version 1.2.3, with the expected behavior being a set-cookie header in the response to update the session. **Next Steps:** - Could you please confirm if this issue is still relevant to the latest version of the better-auth repository? If so, feel free to comment to keep the discussion open. - If there is no further activity, this issue will be automatically closed in 7 days. Thank you for your understanding and contribution!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#789