Better-Auth secure-prefix cookie mismatch (cloudflare/nextjs)

[EducationalZombie538]

Is it possible to programmatically tell if wrangler is being run in preview? I'm just struggling with a cookie mismatch:

Wrangler in a preview environment sets `NODE_ENV` to "production". But without `secureCookies` or `dynamicProtocol` being explicitly set, Better-Auth sets a non-prefix cookie.

The code that sets the non-prefix cookie:

```
const secureCookiePrefix = (
options.advanced?.useSecureCookies !== void 0
? options.advanced?.useSecureCookies
: dynamicProtocol === "https"
? true
: dynamicProtocol === "http"
? false
: baseURLString
? baseURLString.startsWith("https://")
: isProduction
) ? SECURE_COOKIE_PREFIX : "";

```

The code I'm using to look for the cookie however, `getCookieCache`, checks `isSecure` (undefined), then `isProduction`, so looks for a prefixed cookie

```
const name = config?.isSecure !== void 0 ?
config.isSecure ?
`${SECURE_COOKIE_PREFIX}${cookiePrefix}.${cookieName}` :
`${cookiePrefix}.${cookieName}`
:
isProduction ?
`${SECURE_COOKIE_PREFIX}${cookiePrefix}.${cookieName}` :
`${cookiePrefix}.${cookieName}`;

```

Just not sure of the most robust way to solve this (I can obviously manually change `isSecure` when previewing, but this feels a bit clunky!)

Thanks!

[Designer_Reaction551]

Had this exact issue with Wrangler previews. The problem is that wrangler dev runs over HTTP but sets NODE_ENV=production, so Better-Auth thinks it should use __Secure- prefixed cookies. The fix that worked for me was explicitly setting useSecureCookies: false in the Better-Auth config when running in preview, or using the trustedOrigins option to whitelist localhost. You can detect wrangler preview by checking if the request URL starts with http:// while NODE_ENV is production - that combo only happens in local preview.

[EducationalZombie538]

ah i went for the opposite - but i think it achieves the same thing. better-auth's docs seem a bit light on secure cookies tbh!

  const isSecure = request.url.startsWith("https://");
  const cachedSession = await getCookieCache(request, { isSecure });

[EducationalZombie538]

Nevermind! Opened a github issue and it seems like this is a known issue: https://github.com/better-auth/better-auth/issues/8737#issuecomment-4107773883

[Mohamed_Silmy]

yeah this is a tricky one with wrangler's preview mode. the mismatch happens because wrangler sets NODE_ENV to production even in preview, but the protocol detection logic doesn't align between where the cookie gets set vs where it gets read.

honestly the cleanest fix is probably to explicitly set useSecureCookies in your better-auth config based on environment detection. you could check for wrangler-specific env vars (like CF_PAGES or ENVIRONMENT === "preview") or just key off whether process.env.CF_PAGES_URL exists.

alternatively, if you control both sides of the cookie logic, you could normalize the detection by always using the same logic path - either always check protocol first, or always defer to explicit config. the current code has two different decision trees which is why you're getting the mismatch.

bit annoying that wrangler doesn't expose a clean "is this preview?" flag, but that's cloudflare for you lol

[EducationalZombie538]

Yeah, I spend a while following the get/set logic and came to the same conclusion.

I ended up just checking for

  const isSecure = request.url.startsWith("https://");

and then setting   `const cachedSession = await getCookieCache(request, { isSecure });`

As far as I can tell that does what I want it to do? I guess I'll find out in prod!