github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 06:16:18 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #679] Export default CORS options for various backends, add NodeJS CORS to documentation #8375

New Issue
Closed
opened 2026-04-13 03:26:54 -05:00 by GiteaMirror · 4 comments
GiteaMirror commented 2026-04-13 03:26:54 -05:00
Owner
Copy Link

Originally created by @hankportney on GitHub (Nov 28, 2024).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/679

When following the Node setup guide and creating an express server, I quickly discovered my server was blocking cross-origin requests--despite adding my client URLs to "allowed origins". With some quick experimentation, I found that this is because Better Auth is not itself handling CORS; so I had to install the cors package, despite the fact this is not included in the documentation page and example. Notably, the Hono example includes CORS setup, so I was able to figure out what options were appropriate by pattern matching and wished that were just on the Node page.

To make this easier for future consumers, I'd love/recommend the following:

  1. Can the Node docs be updated to include CORS in the example, ideally with the required options clearly delinated?
  2. Can better auth include/export the recommended options directly, so that default implementations will automatically respond to changes in the library's configuration?. I'd imagine this could be something like import { corsOptions } from "better-auth/express" or the equivalent from "better-auth/hono", etc.

If the Hono page's options are correct, those options for the cors package for express should be:

{
	origin: "http://localhost:3000", // Replace with your client origin
	allowedHeaders: ["Content-Type", "Authorization"],
	methods: ["GET", "POST", "OPTIONS"],
	exposedHeaders: ["Content-Length"],
	maxAge: 600,
	credentials: true
}

Thanks!

Originally created by @hankportney on GitHub (Nov 28, 2024). Original GitHub issue: https://github.com/better-auth/better-auth/issues/679 When following the Node setup guide and creating an express server, I quickly discovered my server was blocking cross-origin requests--despite adding my client URLs to "allowed origins". With some quick experimentation, I found that this is because Better Auth is not itself handling CORS; so I had to install the `cors` package, despite the fact this is not included in the documentation page and example. Notably, the Hono example includes CORS setup, so I was able to figure out what options were appropriate by pattern matching and wished that were just on the Node page. To make this easier for future consumers, I'd love/recommend the following: 1. Can the Node docs be updated to include CORS in the example, ideally with the required options clearly delinated? 2. **Can better auth include/export the recommended options directly, so that default implementations will automatically respond to changes in the library's configuration?**. I'd imagine this could be something like `import { corsOptions } from "better-auth/express"` or the equivalent from `"better-auth/hono"`, etc. If the Hono page's options are correct, those options for the `cors` package for express should be: ``` { origin: "http://localhost:3000", // Replace with your client origin allowedHeaders: ["Content-Type", "Authorization"], methods: ["GET", "POST", "OPTIONS"], exposedHeaders: ["Content-Length"], maxAge: 600, credentials: true } ``` Thanks!
GiteaMirror added the lockedgood first issue labels 2026-04-13 03:26:54 -05:00
GiteaMirror commented 2026-04-13 03:26:56 -05:00
Author
Owner
Copy Link

@liutongechao commented on GitHub (Dec 2, 2024):

Hi! I’m really interested in this project and would love to contribute. Should I wait for an assignment or just dive in? @Bekacru

<!-- gh-comment-id:2511745872 --> @liutongechao commented on GitHub (Dec 2, 2024): Hi! I’m really interested in this project and would love to contribute. Should I wait for an assignment or just dive in? @Bekacru
GiteaMirror commented 2026-04-13 03:26:57 -05:00
Author
Owner
Copy Link

@Bekacru commented on GitHub (Dec 3, 2024):

Hi! I’m really interested in this project and would love to contribute. Should I wait for an assignment or just dive in? @Bekacru

hey yeah go for it

<!-- gh-comment-id:2513680854 --> @Bekacru commented on GitHub (Dec 3, 2024): > Hi! I’m really interested in this project and would love to contribute. Should I wait for an assignment or just dive in? @Bekacru hey yeah go for it
GiteaMirror commented 2026-04-13 03:26:57 -05:00
Author
Owner
Copy Link

@liutongechao commented on GitHub (Dec 3, 2024):

For point 1, we can add the CORS case to the docs.
For point 2, I’m not sure if providing a default CORS option is appropriate. @hankportney
Any thoughts? @Bekacru

<!-- gh-comment-id:2514269980 --> @liutongechao commented on GitHub (Dec 3, 2024): For point 1, we can add the CORS case to the docs. For point 2, I’m not sure if providing a default CORS option is appropriate. @hankportney Any thoughts? @Bekacru
GiteaMirror commented 2026-04-13 03:26:58 -05:00
Author
Owner
Copy Link

@Bekacru commented on GitHub (Jan 13, 2025):

docs for express cors config is added

<!-- gh-comment-id:2586445286 --> @Bekacru commented on GitHub (Jan 13, 2025): docs for express cors config is added
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label good first issue locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#8375
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?