Fix delayed sign-out after email verification - #2621
Conversation
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Visual recap — screenshot failedA recap was published, but the PR-comment screenshot could not be captured or uploaded. Open the interactive recap directly: Open the full interactive recap Diagnostic: light: page.goto: Timeout 45000ms exceeded. Call log: - navigating to "https://plan.agent-native.com/recaps/recap-bf26660180af4bce?recapScreenshot=1&recapScreenshotTheme=light", waiting until "domcontentloaded" |
![builder-io-integration[bot]](https://avatars.githubusercontent.com/in/353721?s=60&v=4){kind=small}
There was a problem hiding this comment.
Builder reviewed your changes — looks good ✅
Review Details
Code Review Summary
PR #2621 fixes delayed sign-out for newly verified accounts by forwarding Better Auth's session-clearing Set-Cookie headers through the shared logout and logout-all routes, while also disabling HTTP caching for Clips desktop and mobile session probes. The approach is consistent with the existing auth architecture: it preserves Better Auth's response cookies, keeps the shared route behavior centralized, and adds focused regression coverage for the AUTH_DISABLED/browser logout path. The desktop and mobile changes are appropriately limited to their session bridge/probe fetches.
Risk: High — this changes authentication and session handling. I found no confirmed actionable defects after two independent reviews. In particular, the optional chaining on the h3 response headers is not an actionable failure in these request handlers: h3 provides the response headers, and the added regression test verifies the forwarded cookie. The getSetCookie() compatibility fallback and returnHeaders: true usage are also appropriate.
Key Findings
- No high- or medium-severity findings.
- ✅ Shared logout paths now preserve Better Auth cookie invalidation.
- ✅ Native session probes bypass stale HTTP cache responses.
- ✅ Regression coverage verifies the forwarded session cookie.
🧪 Browser testing: Attempted full verification, but execution was blocked because browser/Chrome automation tools are unavailable in this environment; the dev server was healthy. Native desktop/mobile flows were source-verified only.
2 participants
Short description: Make sign-out take effect immediately for newly verified accounts across web, desktop, and mobile.
Summary
This change fixes an issue where users who had just verified a new email and password account could appear to remain signed in after choosing sign out. Sign-out now takes effect immediately instead of waiting for a cached session to expire.
Changes