[PR #147] [CLOSED] fix: include credentials in RSC fetch calls and match better-auth error format #348

New issue

Closed

opened 2026-05-06 12:39:21 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 12:39:21 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/147
Author: @CodyBontecou
Created: 2/27/2026
Status: ❌ Closed

Base: main ← Head: main

📝 Commits (3)

fd23615 fix: include credentials in RSC fetch calls for auth cookie support
1ae8759 fix: add credentials to prefetch and router fetch calls
a4ec5e7 fix: match error message format expected by better-auth

📊 Changes

4 files changed (+21 additions, -6 deletions)

View changed files

📝 packages/vinext/src/server/app-dev-server.ts (+8 -2)
📝 packages/vinext/src/shims/headers.ts (+11 -3)
📝 packages/vinext/src/shims/navigation.ts (+1 -0)
📝 packages/vinext/src/shims/router.ts (+1 -1)

📄 Description

Summary

Fixes #85 - Authentication cookies not sent during client-side RSC navigation

Problem

Two issues were causing authentication to fail with better-auth:

Client-side RSC fetch calls were missing credentials: 'include' - When navigating between pages, the RSC fetch requests didn't include cookies, causing authenticated users to appear logged out.
Error message format incompatibility with better-auth - better-auth's nextCookies() plugin catches errors starting with "`cookies` was called outside a request scope." to gracefully handle unavailable cookie context. Vinext was throwing a different error message, causing better-auth to fail instead of gracefully degrading.

Changes

1. Add `credentials: 'include'` to all client-side fetch calls

app-dev-server.ts: Server actions, RSC hydration fallback, navigation fetch, HMR refresh
navigation.ts: Prefetch requests
router.ts: Pages Router navigation

2. Fix error message format for better-auth compatibility

Changed cookies() and headers() error messages to start with the prefix that better-auth expects:

// Before
throw new Error("cookies() can only be called from a Server Component...");

// After  
throw new Error("\`cookies\` was called outside a request scope. cookies() can only be called...");

Testing

Tested with a production app using better-auth on Cloudflare Workers:

✅ Homepage shows authenticated state
✅ Clicking navigation links maintains authentication
✅ Direct URL navigation works
✅ Full page reloads maintain authentication

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/147 **Author:** [@CodyBontecou](https://github.com/CodyBontecou) **Created:** 2/27/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `main` --- ### 📝 Commits (3) - [`fd23615`](https://github.com/cloudflare/vinext/commit/fd23615eb981feeb069dec32312b20ee5b7985cb) fix: include credentials in RSC fetch calls for auth cookie support - [`1ae8759`](https://github.com/cloudflare/vinext/commit/1ae87591cbc2a13878b85229d381543dd95c7683) fix: add credentials to prefetch and router fetch calls - [`a4ec5e7`](https://github.com/cloudflare/vinext/commit/a4ec5e78ffa6ba146e3ca3bd6348f605c60eb114) fix: match error message format expected by better-auth ### 📊 Changes **4 files changed** (+21 additions, -6 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/server/app-dev-server.ts` (+8 -2) 📝 `packages/vinext/src/shims/headers.ts` (+11 -3) 📝 `packages/vinext/src/shims/navigation.ts` (+1 -0) 📝 `packages/vinext/src/shims/router.ts` (+1 -1) </details> ### 📄 Description ## Summary Fixes #85 - Authentication cookies not sent during client-side RSC navigation ## Problem Two issues were causing authentication to fail with better-auth: 1. **Client-side RSC fetch calls were missing `credentials: 'include'`** - When navigating between pages, the RSC fetch requests didn't include cookies, causing authenticated users to appear logged out. 2. **Error message format incompatibility with better-auth** - better-auth's `nextCookies()` plugin catches errors starting with "\`cookies\` was called outside a request scope." to gracefully handle unavailable cookie context. Vinext was throwing a different error message, causing better-auth to fail instead of gracefully degrading. ## Changes ### 1. Add `credentials: 'include'` to all client-side fetch calls - `app-dev-server.ts`: Server actions, RSC hydration fallback, navigation fetch, HMR refresh - `navigation.ts`: Prefetch requests - `router.ts`: Pages Router navigation ### 2. Fix error message format for better-auth compatibility Changed `cookies()` and `headers()` error messages to start with the prefix that better-auth expects: ```typescript // Before throw new Error("cookies() can only be called from a Server Component..."); // After throw new Error("\`cookies\` was called outside a request scope. cookies() can only be called..."); ``` ## Testing Tested with a production app using better-auth on Cloudflare Workers: - ✅ Homepage shows authenticated state - ✅ Clicking navigation links maintains authentication - ✅ Direct URL navigation works - ✅ Full page reloads maintain authentication --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>