github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

Request Object Not Passed to Organization Hooks When Called Server-Side #883

New Issue
Closed
opened 2026-03-13 08:08:43 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-03-13 08:08:43 -05:00
Owner
Copy Link

Originally created by @kdcokenny on GitHub (Mar 20, 2025).

Is this suited for github?

  • Yes, this is suited for github

Is your feature request related to a problem? Please describe.

When running organizationCreation's beforeCreate and afterCreate hooks, the req (request) parameter is not being passed in when calling the API from the server side. This makes it impossible to access request headers and authentication context within these hooks, which is critical for operations that require authenticated API calls (like updating an organization after creation).

For example, in the afterCreate hook, I need to access the session token from the request headers to make an authenticated call to updateOrganization, but req is undefined:

afterCreate: async ({ organization, user }, req) => {
  // req is undefined here when called from server
  // This causes issues when trying to make authenticated API calls
}

Describe the solution you'd like

Make the request object consistently available in all hooks, regardless of whether the API is called from client or server side.

As mentioned by bekacru, consider making request a context instead so it can pass all the context from the endpoint. This would ensure that authentication context and headers are always available in hooks, providing a consistent experience regardless of where the API is called from.

Describe alternatives you've considered

I've implemented a workaround by passing both the request object and headers explicitly:

const organization = await auth.api.createOrganization({
  request: req,
  headers: req.headers, // Redundant as req already contains headers
  body: {
    name: body.companyName,
    slug: "",
    company_size: body.companySize,
  },
});

This works but feels redundant since the request already contains the headers. I also considered moving the organization creation logic to client-side, but this isn't feasible for my use case which requires server-side processing.

Additional context

https://discord.com/channels/1288403910284935179/1351624988691795968

This issue is particularly important for maintaining authentication context in server-side operations. The current behavior creates an inconsistency between client-side and server-side API calls, making it difficult to build reliable server-side flows that need to perform multiple authenticated operations.

The workaround suggested by bekacru (passing both request and headers) works but introduces redundancy in the API and isn't obvious from the documentation.

Originally created by @kdcokenny on GitHub (Mar 20, 2025). ### Is this suited for github? - [x] Yes, this is suited for github ### Is your feature request related to a problem? Please describe. When running `organizationCreation`'s `beforeCreate` and `afterCreate` hooks, the `req` (request) parameter is not being passed in when calling the API from the server side. This makes it impossible to access request headers and authentication context within these hooks, which is critical for operations that require authenticated API calls (like updating an organization after creation). For example, in the `afterCreate` hook, I need to access the session token from the request headers to make an authenticated call to `updateOrganization`, but `req` is undefined: ```js afterCreate: async ({ organization, user }, req) => { // req is undefined here when called from server // This causes issues when trying to make authenticated API calls } ``` ### Describe the solution you'd like Make the request object consistently available in all hooks, regardless of whether the API is called from client or server side. As mentioned by bekacru, consider making `request` a `context` instead so it can pass all the context from the endpoint. This would ensure that authentication context and headers are always available in hooks, providing a consistent experience regardless of where the API is called from. ### Describe alternatives you've considered I've implemented a workaround by passing both the request object and headers explicitly: ```ts const organization = await auth.api.createOrganization({ request: req, headers: req.headers, // Redundant as req already contains headers body: { name: body.companyName, slug: "", company_size: body.companySize, }, }); ``` This works but feels redundant since the request already contains the headers. I also considered moving the organization creation logic to client-side, but this isn't feasible for my use case which requires server-side processing. ### Additional context https://discord.com/channels/1288403910284935179/1351624988691795968 This issue is particularly important for maintaining authentication context in server-side operations. The current behavior creates an inconsistency between client-side and server-side API calls, making it difficult to build reliable server-side flows that need to perform multiple authenticated operations. The workaround suggested by bekacru (passing both `request` and `headers`) works but introduces redundancy in the API and isn't obvious from the documentation.
GiteaMirror commented 2026-03-13 08:08:44 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Aug 2, 2025):

Hi, @kdcokenny. I'm Dosu, and I'm helping the better-auth team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You reported that the req object is not passed to organizationCreation hooks like beforeCreate and afterCreate when called server-side.
  • This limits access to authentication context needed for operations such as updating an organization.
  • You requested consistent availability of the request object in all hooks, ideally passed as context to maintain access to headers and auth info.
  • Currently, the workaround requires passing both request and headers redundantly, which is suboptimal and poorly documented.
  • The issue remains unresolved with no recent updates or fixes.

Next Steps:

  • Please confirm if this issue is still relevant with the latest version of better-auth by commenting here.
  • If no response is received within 7 days, I will automatically close the issue.

Thank you for your understanding and contribution!

@dosubot[bot] commented on GitHub (Aug 2, 2025): Hi, @kdcokenny. I'm [Dosu](https://dosu.dev), and I'm helping the better-auth team manage their backlog and am marking this issue as stale. **Issue Summary:** - You reported that the `req` object is not passed to `organizationCreation` hooks like `beforeCreate` and `afterCreate` when called server-side. - This limits access to authentication context needed for operations such as updating an organization. - You requested consistent availability of the request object in all hooks, ideally passed as context to maintain access to headers and auth info. - Currently, the workaround requires passing both `request` and `headers` redundantly, which is suboptimal and poorly documented. - The issue remains unresolved with no recent updates or fixes. **Next Steps:** - Please confirm if this issue is still relevant with the latest version of better-auth by commenting here. - If no response is received within 7 days, I will automatically close the issue. Thank you for your understanding and contribution!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#883
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?