oauth_state cookie is not removed after consumption #7352
Description
Is this suited for github?
- Yes, this is suited for github
To Reproduce
With account.storeStateStrategy: "cookie" and an OAuth provider, go through a successful login flow and observe the Set-Cookie: headers along the way.
Current vs. Expected behavior
Current behavior: the __Secure-better-auth.oauth_state cookie is still there
Expected behavior: the __Secure-better-auth.oauth_state cookie is deleted/cleared after login completes and the cookie is consumed.
Observations:
Upon the POST to /api/auth/sign-in/social, this cookie is set:
__Secure-better-auth.oauth_state=...redacted...; Max-Age=600000; Path=/; HttpOnly; Secure; SameSite=Lax
Upon the GET to /api/auth/callback/providername, this cookie is set:
__Secure-better-auth.oauth_state=; Max-Age=0; Secure
However the browser would not respect this deletion of the cookie as the Path does not match. The Path should also be set when clearing the cookie in order to successfully clear it. This is done in the codebase on some code paths, but not for this oauth_state cookie.
What version of Better Auth are you using?
1.4.10
System info
{
"system": {
"platform": "linux",
"arch": "arm64",
"version": "#51-Ubuntu SMP PREEMPT_DYNAMIC Sat Nov 9 18:03:35 UTC 2024",
"release": "6.8.0-50-generic",
"cpuCount": 3,
"cpuModel": "unknown",
"totalMemory": "9.69 GB",
"freeMemory": "5.64 GB"
},
"node": {
"version": "v24.10.0",
"env": "development"
},
"packageManager": {
"name": "npm",
"version": "11.6.1"
},
"frameworks": [
{
"name": "express",
"version": "^5.2.1"
},
{
"name": "astro",
"version": "^5.16.6"
}
],
"databases": null,
"betterAuth": {
"version": "^1.4.10",
"config": {
"baseURL": "http://localhost:4321",
"secret": "[REDACTED]",
"session": {
"cookieCache": {
"enabled": true,
"maxAge": 172800,
"strategy": "jwe",
"refreshCache": true
}
},
"account": {
"storeStateStrategy": "cookie",
"storeAccountCookie": true
},
"plugins": [
{
"name": "custom-social-providers",
"config": {
"id": "custom-social-providers"
}
},
{
"name": "oauth-proxy",
"config": {
"id": "oauth-proxy",
"options": {},
"endpoints": {},
"hooks": {
"before": [
{},
{},
{}
],
"after": [
{},
{},
{}
]
}
}
}
]
}
}
}Which area(s) are affected? (Select all that apply)
Backend
Auth config (if applicable)
Additional context
I was using a Microsoft Entra ID social provider but I don't think it affects this, the key thing is that it is in the stateless mode config without database.