Invalid Origin (v0.7)

[mrekh]

I'm encountering an "Invalid Origin" error when using Better Auth component (v0.7.12) in my application. Based on the documentation, this version should not have CORS issues.

Setup:

In lib/auth.ts, I've implemented the provided code from the documentation, updating it to utilize an environment variable (NEXT_PUBLIC_SITE_URL) for siteUrl:

import { type GenericCtx } from "@convex/_generated/server";
import { betterAuthComponent } from "@convex/auth";

import { convexAdapter } from "@convex-dev/better-auth";
import { convex } from "@convex-dev/better-auth/plugins";
import { betterAuth } from "better-auth";

// You'll want to replace this with an environment variable
const siteUrl = process.env.NEXT_PUBLIC_SITE_URL;

export const createAuth = (ctx: GenericCtx) =>
	// Configure your Better Auth instance here
	betterAuth({
		// All auth requests will be proxied through your next.js server
		baseURL: siteUrl,
		database: convexAdapter(ctx, betterAuthComponent),

		// Simple non-verified email/password to get started
		emailAndPassword: {
			enabled: true,
			requireEmailVerification: false,
		},
		plugins: [
			// The Convex plugin is required
			convex(),
		],
	});

Problem:

When attempting to sign up on my Vercel production domain, the "Invalid Origin" error appears. Simultaneously, my Convex dashboard displays a corresponding error. The NEXT_PUBLIC_SITE_URL environment variable is correctly set in my Vercel environment.

Suspected Cause & Suggestion:

This appears to be a bug. If not, it would be beneficial to add a section to the documentation instructing users to set trustedOrigins in their createAuth configuration to prevent this issue.

[erquhart]

This isn't a CORS issue, trustedOrigins is used by Better Auth to allowlist specific origins on requests. NEXT_PUBLIC_SITE_URL needs to be set to your app domain in the Convex dashboard, guessing it's undefined here or maybe set to your Convex site url (ends in .site).

[mrekh]

That's a good point. I wasn't aware that it was something that needed to be set in the Convex environment variables.