Better Auth•5w ago

getSessionCookie() return null is some cases

its confusing for some of us that getSessionCookie() is not behaving like we expect for the next reasons: - the function is not respecting the auth options specified in auth.ts

advanced: {
  cookies: {
    session_token: {
      name: "custom_session_token",
    },
  },
  cookiePrefix: custom_cookie_prefix,
   useSecureCookies: true
}

advanced: {
  cookies: {
    session_token: {
      name: "custom_session_token",
    },
  },
  cookiePrefix: custom_cookie_prefix,
   useSecureCookies: true
}

because if you import the config option it will not be compatible with edge runtime. therefore you should specify the config as the second argument if cookie name or prefix is customized.

    const sessionCookie = getSessionCookie(request, {
        cookiePrefix: custom_cookie_prefix,
                cookieName: custom_cookie_name
    });

    const sessionCookie = getSessionCookie(request, {
        cookiePrefix: custom_cookie_prefix,
                cookieName: custom_cookie_name
    });

- in dev mode if you are running your server in https:// cookies will be secured by default if you don't specify the useSecureCookies option.

const secure =
    options.advanced?.useSecureCookies !== undefined
        ? options.advanced?.useSecureCookies
        : options.baseURL !== undefined
            ? options.baseURL.startsWith("https://")
                ? true
                : false
            : isProduction;

const secure =
    options.advanced?.useSecureCookies !== undefined
        ? options.advanced?.useSecureCookies
        : options.baseURL !== undefined
            ? options.baseURL.startsWith("https://")
                ? true
                : false
            : isProduction;

and the function is only prefixing the cookie __secure- in production ignoring the code above

const name = isProduction
        ? `__Secure-${cookiePrefix}.${cookieName}`
        : `${cookiePrefix}.${cookieName}`;

const name = isProduction
        ? `__Secure-${cookiePrefix}.${cookieName}`
        : `${cookiePrefix}.${cookieName}`;

IMHO: It could more clear to explain this in the docs and the function should also check for request.nextUrl.origin.startsWith("https://" to add the secure prefix.

17 Replies

AhmedOP•5w ago

Temporary fix:

    const sessionCookie = getSessionCookie(request, {
        cookiePrefix:
            process.env.NODE_ENV === "development" &&
            request.nextUrl.origin.startsWith("https://")
                ? `__Secure-${process.env.APP_NAME}`
                : `${process.env.APP_NAME}`,
// just use '__Secure-' : '' if you don't use cookiePrefix
    });

    const sessionCookie = getSessionCookie(request, {
        cookiePrefix:
            process.env.NODE_ENV === "development" &&
            request.nextUrl.origin.startsWith("https://")
                ? `__Secure-${process.env.APP_NAME}`
                : `${process.env.APP_NAME}`,
// just use '__Secure-' : '' if you don't use cookiePrefix
    });

@joseph013318 @Ravi @shadow @keks

bekacru•4w ago

getSessionCookie doesn't have a context about your auth config, since you can't import auth in your middleware.

AhmedOP•4w ago

sure we can’t as i mention above to be edge compatible. i think the best that can be done is to clarify in the docs and also adjust the logic to check for https:// to add the secure prefix, right now if someone is using --experimental-https in development the session cookie is prefixed with __secure- but the function is only adding the prefix in production rustling in null return Or maybe we can just add an config option useSecureCookies: true and let the user control it. something like this

export const getSessionCookie = (
    request: Request | Headers,
    config?: {
        cookiePrefix?: string;
        cookieName?: string;
                useSecureCookies: boolean;
    },
) => {
    const headers = request instanceof Headers ? request : request.headers;
    const cookies = headers.get("cookie");
    if (!cookies) {
        return null;
    }
    const { 
            cookieName = "session_token",
            cookiePrefix = "better-auth",
            useSecureCookies = isProduction || request.nextUrl.origin.startsWith("https://") } =
        config || {};
    const name = useSecureCookies 
        ? `__Secure-${cookiePrefix}.${cookieName}`
        : `${cookiePrefix}.${cookieName}`;
    const parsedCookie = parseCookies(cookies);
    const sessionToken = parsedCookie.get(name);
    if (sessionToken) {
        return sessionToken;
    }
    return null;
};

export const getSessionCookie = (
    request: Request | Headers,
    config?: {
        cookiePrefix?: string;
        cookieName?: string;
                useSecureCookies: boolean;
    },
) => {
    const headers = request instanceof Headers ? request : request.headers;
    const cookies = headers.get("cookie");
    if (!cookies) {
        return null;
    }
    const { 
            cookieName = "session_token",
            cookiePrefix = "better-auth",
            useSecureCookies = isProduction || request.nextUrl.origin.startsWith("https://") } =
        config || {};
    const name = useSecureCookies 
        ? `__Secure-${cookiePrefix}.${cookieName}`
        : `${cookiePrefix}.${cookieName}`;
    const parsedCookie = parseCookies(cookies);
    const sessionToken = parsedCookie.get(name);
    if (sessionToken) {
        return sessionToken;
    }
    return null;
};

@bekacru if you agree i could help with PR

bekacru•4w ago

sure go for it

joseph013318•4w ago

@Ahmed Does this solves the session null issue? And infinite pending state?

Vinz•4w ago

I have the same problem with getSessionCookie is null. Also when I check for cookies getAll() in the requests. But when I do it like in the docs of next.js https://nextjs.org/docs/app/building-your-application/authentication#optimistic-checks-with-middleware-optional

...
// 3. Decrypt the session from the cookie
const cookie = (await cookies()).get('session')?.value
...

...
// 3. Decrypt the session from the cookie
const cookie = (await cookies()).get('session')?.value
...

The cookie is then present.

bekacru•4w ago

better auth doesn't store a cookie called session unless you change the name of the cookie. For getSessionCookie make sure to provide a config for production environment.

Vinz•4w ago

sorry I wrote it wrong, because I just copy pasted it from the next docs. I had it correct with the default name in my code

const betterAuthSessionToken = (await cookies()).get("better-auth.session_token");
console.log(betterAuthSessionToken)

const betterAuthSessionToken = (await cookies()).get("better-auth.session_token");
console.log(betterAuthSessionToken)

joseph013318•4w ago

Please explain about the config

bekacru•4w ago

you can pass prefix and cookie name if you have changed them in your auth config

export const getSessionCookie = (
    request,
    {
      cookiePrefix?: "";
      cookieName?: "";
    },
) =

export const getSessionCookie = (
    request,
    {
      cookiePrefix?: "";
      cookieName?: "";
    },
) =

AhmedOP•4w ago

https://github.com/better-auth/better-auth/pull/1716

GitHub

fix: getSessionCookie function and improve docs. by ahmed-m-abbass ...

Improved the logic in getSessionCookie() to correctly handle secure prefix and added useSecureCookies config. closes #1487.

Ravi•4w ago

Hi. I migrated away from both getsession() and using auth.api for middleware. Instead I am doing the following:

  const getSessionUrl = request.nextUrl.origin + "/api/auth/get-session";
  const response = await fetch(getSessionUrl, {
    headers: {
      cookie: request.headers.get("cookie") || "",
      disableCookieCache: "true",
    },
    credentials: "include",
  });

joseph013318•4w ago

Hey @Ravi does this solve the infinite pending state issue also?

Ravi•4w ago

Sorry, I'm not aware of this issue. What is it?

joseph013318•4w ago

https://github.com/better-auth/better-auth/issues/1006 This is the issue!

GitHub

useSession() not always triggering a state change · Issue #1006 ·...

Is this suited for github? Yes, this is suited for github To Reproduce Sign in with email and password Use useSession() in the following component: export function AuthLayout({ children }: AppLayou...

arth•2d ago

I was trying to use getSessionCookie just now with my middleware and i kept getting null. so i replaced it with this:

  export async function getSessionCookie(request: NextRequest, config?: { cookieName: string, cookiePrefix: string, path: string }) {
    // implement middleware logic
    const cookieStore = await import("next/headers").then(mod => mod.cookies());
    return cookieStore.get(`${config?.cookiePrefix || "ft-auth"}.${config?.cookieName || "session_token"}`);
  }

  export async function getSessionCookie(request: NextRequest, config?: { cookieName: string, cookiePrefix: string, path: string }) {
    // implement middleware logic
    const cookieStore = await import("next/headers").then(mod => mod.cookies());
    return cookieStore.get(`${config?.cookiePrefix || "ft-auth"}.${config?.cookieName || "session_token"}`);
  }

this works https://discord.com/channels/1288403910284935179/1356978452326252544

Dawson•2d ago

What a great guy I hope your pillow feels cold on both sides tonight man. Have a great day

Gaming

Programming

getSessionCookie() return null is some cases

Did you find this page helpful?