github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 15:42:09 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #520] Cross sub domain cookie error #8304

New Issue
Closed
opened 2026-04-13 03:22:41 -05:00 by GiteaMirror · 7 comments
GiteaMirror commented 2026-04-13 03:22:41 -05:00
Owner
Copy Link

Originally created by @charlietlamb on GitHub (Nov 13, 2024).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/520

My session_token cookie is disappearing on refresh/new page so I can't authenticate users.

Frontend url: remio.up.railway.app
Backend url: remio-api.up.railway.app
(same domain)

Cookie settings in auth.ts are attatched. Assumed I don't need to change domain in auth.ts as this is the same for both?

In my logs I call get-session after logging in which returns a 200 then I get redirected to /dashboard then call get-session again and get a 401 as the cookie has disappeared.

I've looked all through the docs and can't see anything about this issue - is there something else I need to persist the cookies.

Frontend is nextjs, backend bun/hono (maybe this is an issue when setting the cookies in nextjs?)

Thank you!
Screenshot 2024-11-11 at 21 12 02
Screenshot 2024-11-11 at 21 12 13
Screenshot 2024-11-13 at 19 43 08

Originally created by @charlietlamb on GitHub (Nov 13, 2024). Original GitHub issue: https://github.com/better-auth/better-auth/issues/520 My session_token cookie is disappearing on refresh/new page so I can't authenticate users. Frontend url: remio.up.railway.app Backend url: remio-api.up.railway.app (same domain) Cookie settings in auth.ts are attatched. Assumed I don't need to change domain in auth.ts as this is the same for both? In my logs I call get-session after logging in which returns a 200 then I get redirected to /dashboard then call get-session again and get a 401 as the cookie has disappeared. I've looked all through the docs and can't see anything about this issue - is there something else I need to persist the cookies. Frontend is nextjs, backend bun/hono (maybe this is an issue when setting the cookies in nextjs?) Thank you! <img width="998" alt="Screenshot 2024-11-11 at 21 12 02" src="https://github.com/user-attachments/assets/0a01f09d-5cd9-45f1-9342-9b81b4dca789"> <img width="635" alt="Screenshot 2024-11-11 at 21 12 13" src="https://github.com/user-attachments/assets/f2a8d6cc-b76f-4c00-97db-d7c132bd9c00"> ![Screenshot 2024-11-13 at 19 43 08](https://github.com/user-attachments/assets/6d294c3d-3bcb-473e-abf5-d92233109e0b)
GiteaMirror added the locked label 2026-04-13 03:22:41 -05:00
GiteaMirror commented 2026-04-13 03:22:43 -05:00
Author
Owner
Copy Link

@codergigachad commented on GitHub (Nov 14, 2024):

I have also encountered this issue in my react vite frontend with hono cf-workers backend on localhost.

The backend is working perfectly fine but when the session is called on the frontend using the useSession() hook. I get the cookie, but the cookie is not sent while fetching the user data. So maybe there's a bug in the react client.

I've also tried using credentials: "include" in fetchOptions in client and it still doesn't send the cookie.

Authconfig
image

Clientconfig
image

User page code
image

This is what's happening

https://github.com/user-attachments/assets/7171e368-f6bf-442d-86e9-5456706fd065

<!-- gh-comment-id:2475521915 --> @codergigachad commented on GitHub (Nov 14, 2024): I have also encountered this issue in my react vite frontend with hono cf-workers backend on localhost. The backend is working perfectly fine but when the session is called on the frontend using the useSession() hook. I get the cookie, but the cookie is not sent while fetching the user data. So maybe there's a bug in the react client. I've also tried using credentials: "include" in fetchOptions in client and it still doesn't send the cookie. Authconfig ![image](https://github.com/user-attachments/assets/d281117f-a97b-41a1-af04-c7de8befe385) Clientconfig ![image](https://github.com/user-attachments/assets/368a2f7e-b0f8-4927-b64f-46f43698500e) User page code ![image](https://github.com/user-attachments/assets/efa5a83a-b4b1-40ba-b01e-59625e8c0428) This is what's happening https://github.com/user-attachments/assets/7171e368-f6bf-442d-86e9-5456706fd065
GiteaMirror commented 2026-04-13 03:22:44 -05:00
Author
Owner
Copy Link

@charlietlamb commented on GitHub (Nov 14, 2024):

https://github.com/user-attachments/assets/063b6035-b0b7-4c31-9e02-83996cde0674

Had to compress hence the bad quality - you can hopefully see that the session cookie flickers - it goes away when the page is refreshed or you go to another route which means you can never go anywhere an authenticated user - i then run get session and replace the cookie that's why it takes a sec to appear

<!-- gh-comment-id:2477280184 --> @charlietlamb commented on GitHub (Nov 14, 2024): https://github.com/user-attachments/assets/063b6035-b0b7-4c31-9e02-83996cde0674 Had to compress hence the bad quality - you can hopefully see that the session cookie flickers - it goes away when the page is refreshed or you go to another route which means you can never go anywhere an authenticated user - i then run get session and replace the cookie that's why it takes a sec to appear
GiteaMirror commented 2026-04-13 03:22:44 -05:00
Author
Owner
Copy Link

@Bekacru commented on GitHub (Nov 26, 2024):

Could you guys please confirm me if this is still an issue after v1?

<!-- gh-comment-id:2501787392 --> @Bekacru commented on GitHub (Nov 26, 2024): Could you guys please confirm me if this is still an issue after v1?
GiteaMirror commented 2026-04-13 03:22:45 -05:00
Author
Owner
Copy Link

@charlietlamb commented on GitHub (Nov 28, 2024):

Pretty sure I gave up with this @Bekacru and just use same site none and secure cookies to get around the issue

<!-- gh-comment-id:2506534666 --> @charlietlamb commented on GitHub (Nov 28, 2024): Pretty sure I gave up with this @Bekacru and just use same site none and secure cookies to get around the issue
GiteaMirror commented 2026-04-13 03:22:45 -05:00
Author
Owner
Copy Link

@codergigachad commented on GitHub (Dec 5, 2024):

@Bekacru it only works while using sameSite: "none" and secure: true. But the main concern is that when I use path: "/" and go to any other page like "/about" the cookie is not persisted. Is this an error with the client library or the server? Or am I doing something wrong.

<!-- gh-comment-id:2520205750 --> @codergigachad commented on GitHub (Dec 5, 2024): @Bekacru it only works while using sameSite: "none" and secure: true. But the main concern is that when I use path: "/" and go to any other page like "/about" the cookie is not persisted. Is this an error with the client library or the server? Or am I doing something wrong.
GiteaMirror commented 2026-04-13 03:22:45 -05:00
Author
Owner
Copy Link

@Bekacru commented on GitHub (Jan 13, 2025):

this has been working for a while now. If there is any issue regarding sub domain cookies, feel free to open a new issue.

<!-- gh-comment-id:2586211327 --> @Bekacru commented on GitHub (Jan 13, 2025): this has been working for a while now. If there is any issue regarding sub domain cookies, feel free to open a new issue.
GiteaMirror commented 2026-04-13 03:22:46 -05:00
Author
Owner
Copy Link

@fernandordev commented on GitHub (May 29, 2025):

I'm having this issue with fastify+prisma on backend and nextjs on front-end. @Bekacru any possible fixes?

<!-- gh-comment-id:2918041001 --> @fernandordev commented on GitHub (May 29, 2025): I'm having this issue with fastify+prisma on backend and nextjs on front-end. @Bekacru any possible fixes?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#8304
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?