cloudflare / cloudflare/vinext
vinext dev: Cloudflare RSC dependency re-optimization makes Better Auth route hang or return 500
- Dominant language
- TypeScript
- Stars
- 8.8k
- Forks
- 406
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 120
Description
## Summary
With vinext App Router and `@cloudflare/vite-plugin`, the first request to a Better Auth route that imports `genericOAuth` from the supported `better-auth/plugins` barrel repeatedly re-optimizes dependencies in the `rsc` environment. The request then hangs or returns 500 because an active module points to a file removed from `node_modules/.vite/deps_rsc`.
This looks related to vitejs/vite#20867, but `@cloudflare/vite-plugin@1.50.0` already sets `optimizeDeps.ignoreOutdatedRequests: true`. The failure still occurs through the Cloudflare runner / RSC environment.
Minimal reproduction: https://github.com/Lqm1/vinext-better-auth-repro
## Versions
- OS: Windows 11
- Node: 24.14.1
- Bun: 1.3.14
- vinext: 1.0.0-beta.4
- Vite: 8.2.0
- @cloudflare/vite-plugin: 1.50.0
- @vitejs/plugin-rsc: 0.5.32
- Better Auth: 1.6.25
- React / React DOM / react-server-dom-webpack: 19.2.8
The same behavior was also reproduced with Better Auth 1.6.19.
## Reproduction
```bash
git clone https://github.com/Lqm1/vinext-better-auth-repro
cd vinext-better-auth-repro
bun install
bun dev
```
In another terminal:
```bash
curl http://localhost:3000/
curl http://localhost:3000/api/auth/get-session
```
On Windows, the repo also contains a script that starts the server and performs both requests:
```powershell
./reproduce.ps1
```
Reproduce from a clean `node_modules/.vite` cache.
## Actual behavior
The root request returns 200. The auth request triggers a sequence like:
```text
[vite] (rsc) dependencies optimized: @better-auth/core, ...
[vite] (rsc) optimized dependencies changed. reloading
[vite] program reload
[vite] (rsc) dependencies optimized: @better-auth/utils, jose, ...
[vite] (rsc) optimized dependencies changed. reloading
...
```
It then hangs or returns 500 with errors such as:
```text
The file does not exist at ".../node_modules/.vite/deps_rsc/react-server-dom-webpack-server.edge.development-BYWavJVA.js?v=74e23e6a"
which is in the optimize deps directory.
```
and:
```text
Internal server error: The file does not exist at ".../node_modules/.vite/deps_rsc/@noble_hashes_hkdf__js.js?v=d7852058"
at runInRunnerObject (workers/runner-worker/index.js:107:3)
at handleAppRscRequest (.../vinext/dist/server/app-rsc-handler.js:554:33)
```
With clean caches, direct Node CLI runs returned the same 500 twice consecutively. Additional clean runs with Better Auth 1.6.25 consistently failed to complete within 30 seconds and logged the same missing optimized-dependency error during a full reload.
## Expected behavior
The Better Auth route should return 200 without invalidating modules that are already executing in the RSC environment.
## Controls / narrowing
All of these make `GET /api/auth/get-session` return 200:
1. Removing `cloudflare()` from `vite.config.ts`.
2. Using the narrower import:
```ts
import { genericOAuth } from "better-auth/plugins/generic-oauth";
```
3. Removing the Generic OAuth plugin entirely.
4. Applying this workaround after the Cloudflare plugin:
```ts
{
name: "disable-rsc-dependency-discovery",
enforce: "post",
config: () => ({
environments: {
rsc: { optimizeDeps: { noDiscovery: true } },
},
}),
}
```
Adding only the Better Auth packages to `optimizeDeps.exclude` was not sufficient: optimization continued through transitive packages such as `better-call`, `jose`, and the Kysely adapters, eventually failing with a different runtime error.
## Notes
The `better-auth/plugins` barrel is a public package export, although the dedicated plugin subpath is a practical application-level workaround. I am filing this in vinext because the minimal reproduction requires vinext's App Router RSC setup and the stack reaches `app-rsc-handler`, but the underlying fix may belong in `@cloudflare/vite-plugin`, Vite, or `@vitejs/plugin-rsc`.
Related:
- vitejs/vite#20867
- vitejs/vite#21364
- cloudflare/workers-sdk#11815
Contributor guide
Research direction
Clone the linked minimal reproduction, run bun install and bun dev, clear node_modules/.vite, then reproduce with curl or reproduce.ps1. Trace the failing request through workers/runner-worker/index.js and app-rsc-handler.ts around the reported runner path, while comparing the Cloudflare plugin and RSC dependency behavior. Done means the Better Auth route returns 200 without invalidating modules already executing in the RSC environment.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- react, typescript, vite
- Domain
- api, backend, build-system
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100