github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-07-17 17:01:18 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #2479] Headers are not available when used via client sdk #9214

New Issue
Closed
opened 2026-04-13 04:36:45 -05:00 by GiteaMirror · 14 comments
GiteaMirror commented 2026-04-13 04:36:45 -05:00
Owner
Copy Link

Originally created by @amal-chandran on GitHub (Apr 29, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/2479

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

Current vs. Expected behavior

Current:

  • the headers are empty in when request is made via client sdk
    Image

Expected:

  • the headers should be preset set-auth-jwt / set-auth-token based on used plugin

What version of Better Auth are you using?

1.2.7

Provide environment information

System:
    OS: Linux 6.5 elementary OS 7.1 Horus 7.1 Horus
    CPU: (16) x64 AMD Ryzen 7 5800H with Radeon Graphics
    Memory: 16.11 GB / 27.25 GB
    Container: Yes
    Shell: 5.8.1 - /usr/bin/zsh
  Binaries:
    Node: 20.15.0 - ~/.nvm/versions/node/v20.15.0/bin/node
    npm: 10.8.1 - ~/.nvm/versions/node/v20.15.0/bin/npm
    bun: 1.1.29 - ~/.bun/bin/bun
  Managers:
    Apt: 2.4.12 - /usr/bin/apt
    Cargo: 1.81.0 - ~/.cargo/bin/cargo
    Homebrew: 4.4.10 - /home/linuxbrew/.linuxbrew/bin/brew
    pip3: 22.0.2 - /usr/bin/pip3
  Utilities:
    CMake: 3.22.1 - /usr/bin/cmake
    Make: 4.3 - /usr/bin/make
    GCC: 11.4.0 - /usr/bin/gcc
    Git: 2.34.1 - /usr/bin/git
    Clang: 14.0.0 - /usr/bin/clang
    Ninja: 1.10.1 - /usr/bin/ninja
    FFmpeg: 4.4.2 - /usr/bin/ffmpeg
    Curl: 7.81.0 - /usr/bin/curl
    OpenSSL: 3.0.2 - /usr/bin/openssl
  Virtualization:
    Docker: 27.0.3 - /usr/bin/docker
    VirtualBox: 7.0.18 - /usr/bin/vboxmanage
  IDEs:
    Nano: 6.2 - /usr/bin/nano
    VSCode: 1.97.0 - /home/amalc/.local/bin/code
  Languages:
    Bash: 5.1.16 - /usr/bin/bash
    Java: 17.0.13 - /usr/bin/javac
    Perl: 5.34.0 - /usr/bin/perl
    Python3: 3.10.13 - /usr/bin/python3
    Rust: 1.81.0 - /home/amalc/.cargo/bin/rustc
  Databases:
    MySQL: 0.22.04.1 - /usr/bin/mysql
    SQLite: 3.44.3 - /home/amalc/Android/Sdk/platform-tools/sqlite3
  Browsers:
    Brave Browser: 126.1.67.123
    Chrome: 133.0.6943.141

Which area(s) are affected? (Select all that apply)

Client, Documentation

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  emailAndPassword: {  
    enabled: true
  },
});

Additional context

No response

Originally created by @amal-chandran on GitHub (Apr 29, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/2479 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce - create a better auth client - configure jwt / bearer plugin in backend - see you are able to get token as header as mentioned in these docs - https://www.better-auth.com/docs/plugins/bearer#1-obtain-the-bearer-token - https://www.better-auth.com/docs/plugins/jwt#retrieve-the-token ### Current vs. Expected behavior Current: - the headers are empty in when request is made via client sdk ![Image](https://github.com/user-attachments/assets/be34a729-9a50-4fbb-a5a9-b1601e8df47d) Expected: - the headers should be preset set-auth-jwt / set-auth-token based on used plugin ### What version of Better Auth are you using? 1.2.7 ### Provide environment information ```bash System: OS: Linux 6.5 elementary OS 7.1 Horus 7.1 Horus CPU: (16) x64 AMD Ryzen 7 5800H with Radeon Graphics Memory: 16.11 GB / 27.25 GB Container: Yes Shell: 5.8.1 - /usr/bin/zsh Binaries: Node: 20.15.0 - ~/.nvm/versions/node/v20.15.0/bin/node npm: 10.8.1 - ~/.nvm/versions/node/v20.15.0/bin/npm bun: 1.1.29 - ~/.bun/bin/bun Managers: Apt: 2.4.12 - /usr/bin/apt Cargo: 1.81.0 - ~/.cargo/bin/cargo Homebrew: 4.4.10 - /home/linuxbrew/.linuxbrew/bin/brew pip3: 22.0.2 - /usr/bin/pip3 Utilities: CMake: 3.22.1 - /usr/bin/cmake Make: 4.3 - /usr/bin/make GCC: 11.4.0 - /usr/bin/gcc Git: 2.34.1 - /usr/bin/git Clang: 14.0.0 - /usr/bin/clang Ninja: 1.10.1 - /usr/bin/ninja FFmpeg: 4.4.2 - /usr/bin/ffmpeg Curl: 7.81.0 - /usr/bin/curl OpenSSL: 3.0.2 - /usr/bin/openssl Virtualization: Docker: 27.0.3 - /usr/bin/docker VirtualBox: 7.0.18 - /usr/bin/vboxmanage IDEs: Nano: 6.2 - /usr/bin/nano VSCode: 1.97.0 - /home/amalc/.local/bin/code Languages: Bash: 5.1.16 - /usr/bin/bash Java: 17.0.13 - /usr/bin/javac Perl: 5.34.0 - /usr/bin/perl Python3: 3.10.13 - /usr/bin/python3 Rust: 1.81.0 - /home/amalc/.cargo/bin/rustc Databases: MySQL: 0.22.04.1 - /usr/bin/mysql SQLite: 3.44.3 - /home/amalc/Android/Sdk/platform-tools/sqlite3 Browsers: Brave Browser: 126.1.67.123 Chrome: 133.0.6943.141 ``` ### Which area(s) are affected? (Select all that apply) Client, Documentation ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ emailAndPassword: { enabled: true }, }); ``` ### Additional context _No response_
GiteaMirror added the stalelocked labels 2026-04-13 04:36:46 -05:00
GiteaMirror commented 2026-04-13 04:36:49 -05:00
Author
Owner
Copy Link

@Kinfe123 commented on GitHub (Apr 30, 2025):

have you added them on your auth client as well ?

<!-- gh-comment-id:2841958496 --> @Kinfe123 commented on GitHub (Apr 30, 2025): have you added them on your auth client as well ?
GiteaMirror commented 2026-04-13 04:36:51 -05:00
Author
Owner
Copy Link

@simonecervini commented on GitHub (Apr 30, 2025):

I think I'm encountering the same issue. @Kinfe123, I can personally confirm that the JWT plugin is added in both clients, but it seems the header isn't being passed in the ctx option, since I can see the set-auth-jwt value in the network tab.

The following code:

const { data } = await authClient.getSession({
  fetchOptions: {
    onSuccess: (ctx) => {
      console.log(ctx.response.headers.keys().toArray());
    },
  },
});

prints ['content-length', 'content-type'], but here's the actual response:

Image
<!-- gh-comment-id:2842529656 --> @simonecervini commented on GitHub (Apr 30, 2025): I think I'm encountering the same issue. @Kinfe123, I can personally confirm that the JWT plugin is added in both clients, but it seems the header isn't being passed in the `ctx` option, since I can see the `set-auth-jwt` value in the network tab. The following code: ```ts const { data } = await authClient.getSession({ fetchOptions: { onSuccess: (ctx) => { console.log(ctx.response.headers.keys().toArray()); }, }, }); ``` prints `['content-length', 'content-type']`, but here's the actual response: <img width="619" alt="Image" src="https://github.com/user-attachments/assets/5fd6d1e5-63bc-4102-aee5-34ae567f7444" />
GiteaMirror commented 2026-04-13 04:36:52 -05:00
Author
Owner
Copy Link

@Kinfe123 commented on GitHub (Apr 30, 2025):

can i check your auth config if possible for both server and client one ?

<!-- gh-comment-id:2843592890 --> @Kinfe123 commented on GitHub (Apr 30, 2025): can i check your auth config if possible for both server and client one ?
GiteaMirror commented 2026-04-13 04:36:53 -05:00
Author
Owner
Copy Link

@simonecervini commented on GitHub (May 1, 2025):

can i check your auth config if possible for both server and client one ?

It's a CORS issue, I needed to manually add Set-Auth-Jwt to the exposeHeaders array. It could still be a bug though, because I see in the source that better-auth tries to set the Access-Control-Expose-Headers header automatically

c8b4392854/packages/better-auth/src/plugins/jwt/index.ts (L392)

<!-- gh-comment-id:2844397251 --> @simonecervini commented on GitHub (May 1, 2025): > can i check your auth config if possible for both server and client one ? It's a CORS issue, I needed to manually add `Set-Auth-Jwt` to the `exposeHeaders` array. It could still be a bug though, because I see in the source that better-auth tries to set the `Access-Control-Expose-Headers` header automatically https://github.com/better-auth/better-auth/blob/c8b43928544d76baa1579928e2f5cf70f4be5461/packages/better-auth/src/plugins/jwt/index.ts#L392
GiteaMirror commented 2026-04-13 04:36:54 -05:00
Author
Owner
Copy Link

@Kinfe123 commented on GitHub (May 1, 2025):

can you try installing this patch and let me know if the issue still persists -
npm i https://pkg.pr.new/better-auth/better-auth@2505

<!-- gh-comment-id:2844744797 --> @Kinfe123 commented on GitHub (May 1, 2025): can you try installing this patch and let me know if the issue still persists - `npm i https://pkg.pr.new/better-auth/better-auth@2505`
GiteaMirror commented 2026-04-13 04:36:54 -05:00
Author
Owner
Copy Link

@simonecervini commented on GitHub (May 1, 2025):

can you try installing this patch and lemme if the issue still persists - npm i https://pkg.pr.new/better-auth/better-auth@2505

It doesn't seem to be working for me, I still need to manually add Set-Auth-Jwt

Btw this is my cors config (copied from the docs):

export const app = new Hono();

app.use(
  "/auth/*",
  cors({
    origin: "http://localhost:5173", // TODO: use env
    allowHeaders: ["Content-Type", "Authorization"],
    allowMethods: ["POST", "GET", "OPTIONS"],
    exposeHeaders: ["Content-Length"],
    maxAge: 600,
    credentials: true,
  }),
);

app.on(["POST", "GET"], "/auth/**", async (c) => {
  const res = await auth.handler(c.req.raw);
  // ✅ 3 keys: Content-Type, Access-Control-Expose-Headers (w/ Set-Auth-JWT), Set-Auth-Jwt
  // On the client side, I only get Content-Length and Content-Type when reading `ctx.response.headers` on success.
  console.log(res.headers);
  return res;
});
<!-- gh-comment-id:2844903851 --> @simonecervini commented on GitHub (May 1, 2025): > can you try installing this patch and lemme if the issue still persists - `npm i https://pkg.pr.new/better-auth/better-auth@2505` It doesn't seem to be working for me, I still need to manually add `Set-Auth-Jwt` Btw this is my cors config (copied [from the docs](https://www.better-auth.com/docs/integrations/hono#cors)): ```ts export const app = new Hono(); app.use( "/auth/*", cors({ origin: "http://localhost:5173", // TODO: use env allowHeaders: ["Content-Type", "Authorization"], allowMethods: ["POST", "GET", "OPTIONS"], exposeHeaders: ["Content-Length"], maxAge: 600, credentials: true, }), ); app.on(["POST", "GET"], "/auth/**", async (c) => { const res = await auth.handler(c.req.raw); // ✅ 3 keys: Content-Type, Access-Control-Expose-Headers (w/ Set-Auth-JWT), Set-Auth-Jwt // On the client side, I only get Content-Length and Content-Type when reading `ctx.response.headers` on success. console.log(res.headers); return res; }); ```
GiteaMirror commented 2026-04-13 04:36:55 -05:00
Author
Owner
Copy Link

@Kinfe123 commented on GitHub (May 1, 2025):

can you please try it again ? i have updated it.

<!-- gh-comment-id:2845130940 --> @Kinfe123 commented on GitHub (May 1, 2025): can you please try it again ? i have updated it.
GiteaMirror commented 2026-04-13 04:36:56 -05:00
Author
Owner
Copy Link

@simonecervini commented on GitHub (May 1, 2025):

Same issue

<!-- gh-comment-id:2845292577 --> @simonecervini commented on GitHub (May 1, 2025): Same issue
GiteaMirror commented 2026-04-13 04:36:57 -05:00
Author
Owner
Copy Link

@Kinfe123 commented on GitHub (May 1, 2025):

can you actually remove the exposeHeaders and check if there something returned with in the response header

<!-- gh-comment-id:2845354106 --> @Kinfe123 commented on GitHub (May 1, 2025): can you actually remove the exposeHeaders and check if there something returned with in the response header
GiteaMirror commented 2026-04-13 04:36:58 -05:00
Author
Owner
Copy Link

@simonecervini commented on GitHub (May 2, 2025):

If I remove exposeHeaders (or set it to []), it works. Here are the response headers:

{
  'access-control-expose-headers': 'set-auth-jwt',
  'set-auth-jwt': 'ey...',
  'Content-Type': 'application/json'
}
<!-- gh-comment-id:2846801442 --> @simonecervini commented on GitHub (May 2, 2025): If I remove `exposeHeaders` (or set it to `[]`), it works. Here are the response headers: ```ts { 'access-control-expose-headers': 'set-auth-jwt', 'set-auth-jwt': 'ey...', 'Content-Type': 'application/json' } ```
GiteaMirror commented 2026-04-13 04:36:59 -05:00
Author
Owner
Copy Link

@albert-sway commented on GitHub (May 10, 2025):

@simonecervini what ended up working for you? no exposeHeaders but still setting cors? I'm on nextjs and also having this issue, even with the patch from @Kinfe123.

<!-- gh-comment-id:2869139194 --> @albert-sway commented on GitHub (May 10, 2025): @simonecervini what ended up working for you? no `exposeHeaders` but still setting cors? I'm on nextjs and also having this issue, even with the patch from @Kinfe123.
GiteaMirror commented 2026-04-13 04:36:59 -05:00
Author
Owner
Copy Link

@simonecervini commented on GitHub (May 10, 2025):

@simonecervini what ended up working for you? no exposeHeaders but still setting cors? I'm on nextjs and also having this issue, even with the patch from @Kinfe123.

Yeah exactly, CORS config with empty exposeHeaders array

<!-- gh-comment-id:2869141024 --> @simonecervini commented on GitHub (May 10, 2025): > @simonecervini what ended up working for you? no `exposeHeaders` but still setting cors? I'm on nextjs and also having this issue, even with the patch from @Kinfe123. Yeah exactly, CORS config with empty exposeHeaders array
GiteaMirror commented 2026-04-13 04:37:00 -05:00
Author
Owner
Copy Link

@albert-sway commented on GitHub (May 10, 2025):

authClient.token() worked for me!

<!-- gh-comment-id:2869183100 --> @albert-sway commented on GitHub (May 10, 2025): `authClient.token()` worked for me!
GiteaMirror commented 2026-04-13 04:37:01 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Aug 9, 2025):

Hi, @amal-chandran. I'm Dosu, and I'm helping the better-auth team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You reported that Better Auth client SDK v1.2.7 did not send expected JWT/bearer headers on Linux with Node 20.15.0.
  • The problem was identified as a CORS issue involving the Set-Auth-Jwt header needing manual addition to the exposeHeaders array.
  • A patch was provided but did not fully resolve the issue.
  • Removing the exposeHeaders array entirely allowed the header to be received properly, confirmed by multiple users including yourself.

Next Steps:

  • Please confirm if this issue is still relevant with the latest version of the better-auth SDK.
  • If it is, feel free to comment here to keep the discussion open; otherwise, I will automatically close this issue in 7 days.

Thank you for your understanding and contribution!

<!-- gh-comment-id:3171882258 --> @dosubot[bot] commented on GitHub (Aug 9, 2025): Hi, @amal-chandran. I'm [Dosu](https://dosu.dev), and I'm helping the better-auth team manage their backlog and am marking this issue as stale. **Issue Summary:** - You reported that Better Auth client SDK v1.2.7 did not send expected JWT/bearer headers on Linux with Node 20.15.0. - The problem was identified as a CORS issue involving the `Set-Auth-Jwt` header needing manual addition to the `exposeHeaders` array. - A patch was provided but did not fully resolve the issue. - Removing the `exposeHeaders` array entirely allowed the header to be received properly, confirmed by multiple users including yourself. **Next Steps:** - Please confirm if this issue is still relevant with the latest version of the better-auth SDK. - If it is, feel free to comment here to keep the discussion open; otherwise, I will automatically close this issue in 7 days. Thank you for your understanding and contribution!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label locked stale
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#9214
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?