Self hosted instance creates insecure cookies on https potentially exposing better-auth.session_token plaintext
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 37.4k
- Forks
- 3k
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 73
Description
To Reproduce
Configure dokploy instance on https. Login to the system on https. Check the browser cookies and locate 'better-auth.session_token'. The cookie is not secure. As a result the browser can send the session cookie plain text if the user uses http from an old link or by mistake etc making the deployment highly insecure.
Current vs. Expected behavior
better-auth.session_token should be secure on https.
Provide environment information
Default installation script was used.
Which area(s) are affected? (Select all that apply)
Remote server
Are you deploying the applications where Dokploy is installed or on a remote server?
Same server where Dokploy is installed
Additional context
No response
Will you send a PR to fix it?
No
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue on a self-hosted HTTPS instance and inspect where the better-auth.session_token cookie is configured. Trace the authentication setup to the responsible entry point; done means the cookie is marked secure over HTTPS and the behavior is verified without exposing the session token over HTTP.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 64/100