engineering/tpmjs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2.1k

fix: check for __Secure- prefixed session cookie in middleware

Browse source 
better-auth uses __Secure- prefix for session cookies on HTTPS,
but middleware was only checking for the unprefixed cookie name

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Ajax Davis 2026-01-02 01:11:09 +10:00
parent 499f163c31
commit 87a9517ec3
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
apps/web/src/middleware.ts
View file

@ -4,7 +4,10 @@ import type { NextRequest } from 'next/server';
export function middleware(request: NextRequest) {
// Protect /dashboard routes
if (request.nextUrl.pathname.startsWith('/dashboard')) {
const sessionToken = request.cookies.get('better-auth.session_token');
// Check for session token - better-auth uses __Secure- prefix for HTTPS cookies
const sessionToken =
request.cookies.get('__Secure-better-auth.session_token') ||
request.cookies.get('better-auth.session_token');
if (!sessionToken) {
return NextResponse.redirect(new URL('/sign-in', request.url));
}