cloudflare / cloudflare/vinext

vinext dev: Cloudflare RSC dependency re-optimization makes Better Auth route hang or return 500

Open
#2,813 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
8.8k
Forks
406
Avg merge
2d 6h
Merged PRs (30d)
120

Description

## Summary

With vinext App Router and `@cloudflare/vite-plugin`, the first request to a Better Auth route that imports `genericOAuth` from the supported `better-auth/plugins` barrel repeatedly re-optimizes dependencies in the `rsc` environment. The request then hangs or returns 500 because an active module points to a file removed from `node_modules/.vite/deps_rsc`.

This looks related to vitejs/vite#20867, but `@cloudflare/vite-plugin@1.50.0` already sets `optimizeDeps.ignoreOutdatedRequests: true`. The failure still occurs through the Cloudflare runner / RSC environment.

Minimal reproduction: https://github.com/Lqm1/vinext-better-auth-repro

## Versions

- OS: Windows 11
- Node: 24.14.1
- Bun: 1.3.14
- vinext: 1.0.0-beta.4
- Vite: 8.2.0
- @cloudflare/vite-plugin: 1.50.0
- @vitejs/plugin-rsc: 0.5.32
- Better Auth: 1.6.25
- React / React DOM / react-server-dom-webpack: 19.2.8

The same behavior was also reproduced with Better Auth 1.6.19.

## Reproduction

```bash
git clone https://github.com/Lqm1/vinext-better-auth-repro
cd vinext-better-auth-repro
bun install
bun dev
```

In another terminal:

```bash
curl http://localhost:3000/
curl http://localhost:3000/api/auth/get-session
```

On Windows, the repo also contains a script that starts the server and performs both requests:

```powershell
./reproduce.ps1
```

Reproduce from a clean `node_modules/.vite` cache.

## Actual behavior

The root request returns 200. The auth request triggers a sequence like:

```text
[vite] (rsc) dependencies optimized: @better-auth/core, ...
[vite] (rsc) optimized dependencies changed. reloading
[vite] program reload
[vite] (rsc) dependencies optimized: @better-auth/utils, jose, ...
[vite] (rsc) optimized dependencies changed. reloading
...
```

It then hangs or returns 500 with errors such as:

```text
The file does not exist at ".../node_modules/.vite/deps_rsc/react-server-dom-webpack-server.edge.development-BYWavJVA.js?v=74e23e6a"
which is in the optimize deps directory.
```

and:

```text
Internal server error: The file does not exist at ".../node_modules/.vite/deps_rsc/@noble_hashes_hkdf__js.js?v=d7852058"
at runInRunnerObject (workers/runner-worker/index.js:107:3)
at handleAppRscRequest (.../vinext/dist/server/app-rsc-handler.js:554:33)
```

With clean caches, direct Node CLI runs returned the same 500 twice consecutively. Additional clean runs with Better Auth 1.6.25 consistently failed to complete within 30 seconds and logged the same missing optimized-dependency error during a full reload.

## Expected behavior

The Better Auth route should return 200 without invalidating modules that are already executing in the RSC environment.

## Controls / narrowing

All of these make `GET /api/auth/get-session` return 200:

1. Removing `cloudflare()` from `vite.config.ts`.
2. Using the narrower import:
```ts
import { genericOAuth } from "better-auth/plugins/generic-oauth";
```
3. Removing the Generic OAuth plugin entirely.
4. Applying this workaround after the Cloudflare plugin:
```ts
{
name: "disable-rsc-dependency-discovery",
enforce: "post",
config: () => ({
environments: {
rsc: { optimizeDeps: { noDiscovery: true } },
},
}),
}
```

Adding only the Better Auth packages to `optimizeDeps.exclude` was not sufficient: optimization continued through transitive packages such as `better-call`, `jose`, and the Kysely adapters, eventually failing with a different runtime error.

## Notes

The `better-auth/plugins` barrel is a public package export, although the dedicated plugin subpath is a practical application-level workaround. I am filing this in vinext because the minimal reproduction requires vinext's App Router RSC setup and the stack reaches `app-rsc-handler`, but the underlying fix may belong in `@cloudflare/vite-plugin`, Vite, or `@vitejs/plugin-rsc`.

Related:
- vitejs/vite#20867
- vitejs/vite#21364
- cloudflare/workers-sdk#11815

Contributor guide

Open the contributing guide

Research direction

Clone the linked minimal reproduction, run bun install and bun dev, clear node_modules/.vite, then reproduce with curl or reproduce.ps1. Trace the failing request through workers/runner-worker/index.js and app-rsc-handler.ts around the reported runner path, while comparing the Cloudflare plugin and RSC dependency behavior. Done means the Better Auth route returns 200 without invalidating modules already executing in the RSC environment.

Written by the indexing model from the issue text.

Assessment

Tech stack
react, typescript, vite
Domain
api, backend, build-system
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.