github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 08:01:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #126] CSRF Route Not Found #8139

New Issue
Closed
opened 2026-04-13 03:12:58 -05:00 by GiteaMirror · 8 comments
GiteaMirror commented 2026-04-13 03:12:58 -05:00
Owner
Copy Link

Originally created by @vrn-hkz on GitHub (Oct 8, 2024).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/126

better-auth v0.3.3

I have setup the app based on the docs, with the following on a Hono server:

export const auth = betterAuth({
	baseUrl: 'http://localhost:3000',
	basePath: '/api/v1/auth',
	database: kyselyDialect,
	emailAndPassword: {
		enabled: true,
		password: {
			hash: (password) => Bun.password.hash(password),
			verify: (hash, password) => Bun.password.verify(password, hash),
		},
	},
});

app.on(['POST', 'GET'], '/api/v1/auth/**', (c) => auth.handler(c.req.raw));

On the client side:

import { createAuthClient } from 'better-auth/client';

export const authClient = createAuthClient({
	baseURL: 'http://localhost:3000/api/v1/auth',
});

But getting the following error on the client:

BetterAuthError: CSRF route not found. Make sure the server is running and the base URL is correct and includes the path (e.g. http://localhost:3000/api/auth).
      at /xxx/node_modules/better-auth/dist/client.js:7:5

and the following log from the server:

<-- GET /api/v1/auth/csrf
--> GET /api/v1/auth/csrf 404 1ms

Please let me know where I might have gone wrong?

Originally created by @vrn-hkz on GitHub (Oct 8, 2024). Original GitHub issue: https://github.com/better-auth/better-auth/issues/126 better-auth v0.3.3 I have setup the app based on the docs, with the following on a Hono server: ```ts export const auth = betterAuth({ baseUrl: 'http://localhost:3000', basePath: '/api/v1/auth', database: kyselyDialect, emailAndPassword: { enabled: true, password: { hash: (password) => Bun.password.hash(password), verify: (hash, password) => Bun.password.verify(password, hash), }, }, }); ``` ```ts app.on(['POST', 'GET'], '/api/v1/auth/**', (c) => auth.handler(c.req.raw)); ``` On the client side: ```ts import { createAuthClient } from 'better-auth/client'; export const authClient = createAuthClient({ baseURL: 'http://localhost:3000/api/v1/auth', }); ``` But getting the following error on the client: ``` BetterAuthError: CSRF route not found. Make sure the server is running and the base URL is correct and includes the path (e.g. http://localhost:3000/api/auth). at /xxx/node_modules/better-auth/dist/client.js:7:5 ``` and the following log from the server: ``` <-- GET /api/v1/auth/csrf --> GET /api/v1/auth/csrf 404 1ms ``` Please let me know where I might have gone wrong?
GiteaMirror added the locked label 2026-04-13 03:12:58 -05:00
GiteaMirror commented 2026-04-13 03:12:59 -05:00
Author
Owner
Copy Link

@tklein1801 commented on GitHub (Oct 8, 2024):

I haven't used Hono before but have you tried using? I think the path is documented wrong for NodeJS and Hono

app.on(['POST', 'GET'], '/api/v1/auth/', (c) => auth.handler(c.req.raw));
<!-- gh-comment-id:2400661864 --> @tklein1801 commented on GitHub (Oct 8, 2024): I haven't used Hono before but have you tried using? I think the path is documented wrong for NodeJS and Hono ```typescript app.on(['POST', 'GET'], '/api/v1/auth/', (c) => auth.handler(c.req.raw)); ```
GiteaMirror commented 2026-04-13 03:13:00 -05:00
Author
Owner
Copy Link

@vrn-hkz commented on GitHub (Oct 9, 2024):

The way to create wildcard routes in Hono is thru * pattern

app.on(['POST', 'GET'], '/api/v1/auth/*', (c) => auth.handler(c.req.raw));

is correct

https://hono.dev/docs/api/routing

<!-- gh-comment-id:2401053437 --> @vrn-hkz commented on GitHub (Oct 9, 2024): The way to create wildcard routes in Hono is thru * pattern ```ts app.on(['POST', 'GET'], '/api/v1/auth/*', (c) => auth.handler(c.req.raw)); ``` is correct https://hono.dev/docs/api/routing
GiteaMirror commented 2026-04-13 03:13:01 -05:00
Author
Owner
Copy Link

@vrn-hkz commented on GitHub (Oct 9, 2024):

Looks like app.on(['POST, 'GET'], ....) does not work with wildcards on Hono.

I used

app.get('/api/auth/*', (c) => auth.handler(c.req.raw));
app.post('/api/auth/*', (c) => auth.handler(c.req.raw));

And it worked!

But it still isn't working with custom paths. Below does not work and gives a 404

app.get('/api/v1/auth/*', (c) => auth.handler(c.req.raw));
app.post('/api/v1/auth/*', (c) => auth.handler(c.req.raw));
<!-- gh-comment-id:2401203606 --> @vrn-hkz commented on GitHub (Oct 9, 2024): Looks like `app.on(['POST, 'GET'], ....)` does not work with wildcards on Hono. I used ```ts app.get('/api/auth/*', (c) => auth.handler(c.req.raw)); app.post('/api/auth/*', (c) => auth.handler(c.req.raw)); ``` And it worked! But it still isn't working with custom paths. Below does not work and gives a 404 ```ts app.get('/api/v1/auth/*', (c) => auth.handler(c.req.raw)); app.post('/api/v1/auth/*', (c) => auth.handler(c.req.raw)); ```
GiteaMirror commented 2026-04-13 03:13:01 -05:00
Author
Owner
Copy Link

@NuroDev commented on GitHub (Oct 9, 2024):

If this is the case then should the docs be updated to change the current example to use the separate HTTP method approach (app.get(...) & app.post(...)) instead?

<!-- gh-comment-id:2403357439 --> @NuroDev commented on GitHub (Oct 9, 2024): If this is the case then should the docs be updated to change the [current example](https://github.com/better-auth/better-auth/blob/4fe33ee7e8f1ac2d66dc9577973c21351ef2f1e7/docs/content/docs/integrations/hono.mdx?plain=1#L14-L27) to use the separate HTTP method approach (`app.get(...)` & `app.post(...)`) instead?
GiteaMirror commented 2026-04-13 03:13:02 -05:00
Author
Owner
Copy Link

@vrn-hkz commented on GitHub (Oct 10, 2024):

Ideally yes, but the custom paths not working yet. Only /api/auth seems to be hitting

<!-- gh-comment-id:2403820969 --> @vrn-hkz commented on GitHub (Oct 10, 2024): Ideally yes, but the custom paths not working yet. Only `/api/auth` seems to be hitting
GiteaMirror commented 2026-04-13 03:13:03 -05:00
Author
Owner
Copy Link

@Bekacru commented on GitHub (Oct 10, 2024):

Ideally yes, but the custom paths not working yet. Only /api/auth seems to be hitting

it should work since yesterday's release.

<!-- gh-comment-id:2404029919 --> @Bekacru commented on GitHub (Oct 10, 2024): > Ideally yes, but the custom paths not working yet. Only `/api/auth` seems to be hitting it should work since yesterday's release.
GiteaMirror commented 2026-04-13 03:13:04 -05:00
Author
Owner
Copy Link

@Bekacru commented on GitHub (Oct 10, 2024):

If this is the case then should the docs be updated to change the current example to use the separate HTTP method approach (app.get(...) & app.post(...)) instead?

It should work with on, but I believe the matcher needs to be doubled.

app.on(["POST", "GET"], "/api/auth/**", (c) => {
	return auth.handler(c.req.raw);
});

This will be updated in the docs.

<!-- gh-comment-id:2404032391 --> @Bekacru commented on GitHub (Oct 10, 2024): > If this is the case then should the docs be updated to change the [current example](https://github.com/better-auth/better-auth/blob/4fe33ee7e8f1ac2d66dc9577973c21351ef2f1e7/docs/content/docs/integrations/hono.mdx?plain=1#L14-L27) to use the separate HTTP method approach (`app.get(...)` & `app.post(...)`) instead? It should work with `on`, but I believe the matcher needs to be doubled. ```ts app.on(["POST", "GET"], "/api/auth/**", (c) => { return auth.handler(c.req.raw); }); ``` This will be updated in the docs.
GiteaMirror commented 2026-04-13 03:13:05 -05:00
Author
Owner
Copy Link

@vrn-hkz commented on GitHub (Oct 12, 2024):

app.on(['POST', 'GET'], '/api/auth/**', (c) => auth.handler(c.req.raw)); with double matcher does not work, still have to do

app.get('/api/v1/auth/*', (c) => auth.handler(c.req.raw));
app.post('/api/v1/auth/*', (c) => auth.handler(c.req.raw));

But with v0.4.2 the custom routes (/api/v1/*) are working.

<!-- gh-comment-id:2408589990 --> @vrn-hkz commented on GitHub (Oct 12, 2024): `app.on(['POST', 'GET'], '/api/auth/**', (c) => auth.handler(c.req.raw));` with double matcher does not work, still have to do ```ts app.get('/api/v1/auth/*', (c) => auth.handler(c.req.raw)); app.post('/api/v1/auth/*', (c) => auth.handler(c.req.raw)); ``` But with v0.4.2 the custom routes (`/api/v1/*`) are working.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#8139
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?