From 87a9517ec3c1b41fe22fd0dedf907293849cedcc Mon Sep 17 00:00:00 2001 From: Ajax Davis Date: Fri, 2 Jan 2026 01:11:09 +1000 Subject: [PATCH] fix: check for __Secure- prefixed session cookie in middleware MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit better-auth uses __Secure- prefix for session cookies on HTTPS, but middleware was only checking for the unprefixed cookie name 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- apps/web/src/middleware.ts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/apps/web/src/middleware.ts b/apps/web/src/middleware.ts index c1ce3c5..abf8755 100644 --- a/apps/web/src/middleware.ts +++ b/apps/web/src/middleware.ts @@ -4,7 +4,10 @@ import type { NextRequest } from 'next/server'; export function middleware(request: NextRequest) { // Protect /dashboard routes if (request.nextUrl.pathname.startsWith('/dashboard')) { - const sessionToken = request.cookies.get('better-auth.session_token'); + // Check for session token - better-auth uses __Secure- prefix for HTTPS cookies + const sessionToken = + request.cookies.get('__Secure-better-auth.session_token') || + request.cookies.get('better-auth.session_token'); if (!sessionToken) { return NextResponse.redirect(new URL('/sign-in', request.url)); }