Better-Auth 1.4.8 broken and unusable due to trusted origins

[JE4GLE]

To Reproduce

1. Create backend using Svelte and configure better-auth with trustedOrigins on localhost
2. Try to signup or do any action with better-auth

Current behavior

error Invalid origin: http://localhost:5173 []
info If it's a valid URL, please add http://localhost:5173 to trustedOrigins in your auth config
 [
  'Current list of trustedOrigins: http://localhost:5173,http://localhost:5173,http://localhost:5174,http://192.168.178.71:5173,http://192.168.178.71:5174'
]

Expected behavior

No error, the requests work.

What version of Better Auth are you using?

1.4.8

System info

The command npx @better-auth/cli info --json produces no output and results in exit code 1.

Which area(s) are affected? (Select all that apply)

Backend, every auth action

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  trustedOrigins: [
    'http://localhost:5173',
    'http://localhost:5174',
    'http://192.168.178.71:5173',
    'http://192.168.178.71:5174'
  ],
  emailAndPassword: {  
    enabled: true
  },
});

Additional context

It didn't work in 1.4.7 or 1.4.6 either.

[better-auth-agent]

It seems you are facing an "Invalid origin" error while using Better Auth version 1.4.8. This issue usually arises when the origin from which you're making requests isn't included in the trustedOrigins array of your auth config.

To resolve this issue, please check the following steps:

1. Verify trustedOrigins Configuration: Ensure that you have correctly added http://localhost:5173 and any other origins you plan to access in the trustedOrigins array. Here’s an example:

   export const auth = betterAuth({
     trustedOrigins: [
       'http://localhost:5173',
       'http://localhost:5174',
       'http://192.168.178.71:5173',
       'http://192.168.178.71:5174'
     ],
     emailAndPassword: {  
       enabled: true
     },
   });

2. Check Base URL Configuration: Ensure you have defined the baseURL correctly. If baseURL is inferred from the first request, your origins should be evaluated accordingly [11].

3. Environment Variable: Make sure that if you are using an environment variable for trusted origins (e.g. BETTER_AUTH_TRUSTED_ORIGINS), it is set correctly in your environment [7].

If you follow these steps and the error persists, please consider tagging the Better Auth team members Beka and Max (@Bekacru and @ping__) for further assistance.

What other questions do you have regarding Better Auth configurations?

If you need more help, tag @better-auth-agent in a comment so I can respond.

Diagram • Discord • GitHub

[JE4GLE]

@better-auth-agent @Bekacru @ping-maxwell The suggested solution by the agent is not helping. You can see in the error message by Better-Auth that the correct URL is configured. I would say, the validation logic is incorrect.

info If it's a valid URL, please add http://localhost:5173 to trustedOrigins in your auth config
 [
  'Current list of trustedOrigins: http://localhost:5173,http://localhost:5173,http://localhost:5174,http://192.168.178.71:5173,http://192.168.178.71:5174'
]

[better-auth-agent]

It seems that the error you're encountering, indicating an "Invalid origin" for http://localhost:5173, may stem from a few possible issues with your trustedOrigins configuration.

Here are steps you can follow to troubleshoot this problem:

1. Check for Duplicates: Ensure that http://localhost:5173 is not somehow duplicated in your configuration. The error message suggests it appears twice in the list of trustedOrigins.

2. Wildcard Support: Verify that you’re using a proper format. The trustedOrigins list can support wildcards. If you're still facing issues, consider using more flexible patterns that might cover the origins you need, such as http://localhost:* which would allow all ports on localhost.

3. Base URL Inference: There's a fix in place that addresses issues related to base URL inference and trusted origins, which might have affected your setup. If you have any specific configurations that infer base URLs, make sure they are correctly set up to match your trusted origins [6].

4. Version Check: Since you’re using version 1.4.8, ensure there aren’t any outstanding issues or updates from the repository that could resolve related errors.

If these steps don’t resolve your issue, it might be helpful to tag Beka and Max at @Bekacru and @ping__ for further assistance.

What specific configurations are you using with trustedOrigins, and have you considered implementing wildcard patterns to simplify your setup?

Diagram • Discord • GitHub

[Bekacru]

I can't repoduce this issue on my end.

can you make a minimal repro?

[bytaesu]

Hi @JE4GLE,

I couldn't reproduce the issue with this setup. Could you share reproducible code or a repo?

import { getRequestEvent } from "$app/server";
import { betterAuth } from "better-auth";
import { sveltekitCookies } from "better-auth/svelte-kit";
import { Pool } from "pg";
import { DATABASE_URL } from "$env/static/private";

export const auth = betterAuth({
  database: new Pool({
    connectionString: DATABASE_URL,
  }),
    trustedOrigins: [
    'http://localhost:5173',
    'http://localhost:5174',
    'http://192.168.178.71:5173',
    'http://192.168.178.71:5174'
  ],
  emailAndPassword: { 
    enabled: true, 
  }, 
  plugins: [sveltekitCookies(getRequestEvent)],
});

sveltkit.mov

[bytaesu]

@JE4GLE

SvelteKit is indeed a full-stack framework, but it's unclear what you mean by “backend using Svelte” Could you explain how you've set it up? That would help me investigate and resolve your issue 😁

[JE4GLE]

@Bekacru @bytaesu I did some further research and found the error was due to the function getTrustedOrigins(options). It returned an empty array []. The mjs file compiled to the following:

function getTrustedOrigins(options) {
	const baseURL = getBaseURL(options.baseURL, options.basePath);
	if (!baseURL) return [];
	const trustedOrigins = [new URL(baseURL).origin];
	if (options.trustedOrigins && Array.isArray(options.trustedOrigins)) trustedOrigins.push(...options.trustedOrigins);
	const envTrustedOrigins = env.BETTER_AUTH_TRUSTED_ORIGINS;
	if (envTrustedOrigins) trustedOrigins.push(...envTrustedOrigins.split(","));
	if (trustedOrigins.filter((x) => !x).length) throw new BetterAuthError("A provided trusted origin is invalid, make sure your trusted origins list is properly defined.");
	return trustedOrigins;
}

After setting the baseURL, it worked again, but the issue seems to have been introduced in the last few updates as this issue never occurred before.

[himself65]

Fixed in 1.4.9. It's a release issue. We're gonna improve the release process to avoid such dumb issue