Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Revoked Session Remains Authorised by the Cookie Cache for Up to 300 Seconds

Open
  • Is something wrong?
#144 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
49/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
mongodb, next.js, node.js, typescript
Domain
authentication, backend, security

Research direction

Start with lib/better-auth/auth.ts:45-49 and trace how changePassword revokes sessions and how getSession() and requireUserId() authorize requests from the cookie cache. Reproduce the behavior with the real auth configuration, then compare with cookieCache.enabled = false. Done means a revoked device can no longer authorize requests from cached session state, with any remaining cache window documented.

Written by the indexing model from the issue text.

Description

Summary

Sessions are cached in a signed cookie for 300 seconds. changePassword({revokeOtherSessions:true}) deletes the server-side session but does not invalidate the cookie cache, so the revoked device keeps being authorised until the cache expires.

Environment

  • Repository: Open-Dev-Society/OpenStock
  • Target commit: ddf07c742ef8b5b2ad7955eeb786db2ae97996e9
  • File: lib/better-auth/auth.ts:45-49
  • Runtime: Node.js 22; better-auth 1.7.10; Next.js server action

Steps to reproduce

  1. Sign up on device A and sign in on device B against the real auth.ts configuration.
  2. From device A, execute the real changePassword action with revokeOtherSessions: true.
  3. Call getSession() and requireUserId() with device B's cookie.
  4. Repeat with cookieCache.enabled = false as a control.

Expected behavior

A session revoked by revokeOtherSessions must not continue to authorize requests from cached session state.

Actual behavior

After changePassword({ revokeOtherSessions: true }) revokes another device, that device's signed session cookie can still be accepted by getSession for up to 300 seconds and then trusted by requireUserId.

        // Signed session cookie for 5 min: pages stop paying a MongoDB round trip per request.
        // Trade-off: a revoked session can stay valid for up to 5 minutes.
        session: {
            cookieCache: { enabled: true, maxAge: 5 * 60 },
        },

Root cause

Session state is cached in a signed cookie for 300 seconds. Session revocation deletes the server-side record but does not invalidate the cached cookie, so subsequent requests are authorised from the cache until it expires.

Suggested fix

Invalidate the cookie cache on revocation, for example by versioning the session and incrementing the version, disable the cache for sensitive operations, or reduce maxAge to an acceptable window. Document the residual window explicitly.

Impact

After a password change that revokes other sessions, the revoked device retains access to protected resources for up to five minutes. This contradicts the expected semantics of session revocation and may breach a product promise that a password change terminates other sessions immediately.

Note: The source comment acknowledges the trade-off: a revoked session may remain valid for up to five minutes. The finding is therefore a documented design decision as well as a behavioural risk; severity depends on the product requirement for immediate revocation.

Dominant language
TypeScript
Stars
19.8k
Forks
2.4k
Avg merge
13h 8m
Merged PRs (30d)
29

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Open-Dev-Society/OpenStock

All issues in Open-Dev-Society/OpenStock

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.