fix: move res.end() outside stream reading loop in setResponse#129
Closed
roor0 wants to merge 1 commit intobetter-auth:mainfrom
Closed
fix: move res.end() outside stream reading loop in setResponse#129roor0 wants to merge 1 commit intobetter-auth:mainfrom
roor0 wants to merge 1 commit intobetter-auth:mainfrom
Conversation
res.end() was called inside the for loop after a successful res.write(), causing the response to be terminated after the first chunk. This truncates any response body larger than one chunk (~16KB), returning incomplete JSON to the client. This breaks applications with large response payloads (e.g. better-auth customSession with production user data exceeding 16KB). The fix moves res.end() after the loop so the full response body is streamed before ending.
roor0
added a commit
to roor0/better-auth
that referenced
this pull request
Apr 13, 2026
The client's JSON parser was configured with `strict: false`, which causes truncated JSON responses to be silently returned as raw strings instead of throwing an error. This means a response body truncated at a chunk boundary (e.g. due to the res.end() bug in better-call#129) produces a string value that the client treats as valid data, making the failure completely invisible — no error, no warning. With `strict: true`, the JSON parse error surfaces as an actual error, which the client query layer handles properly via `onError`. See: better-auth/better-call#129
roor0
added a commit
to roor0/better-auth
that referenced
this pull request
Apr 13, 2026
The client's JSON parser was configured with `strict: false`, which causes truncated JSON responses to be silently returned as raw strings instead of throwing an error. This means a response body truncated at a chunk boundary (e.g. due to the res.end() bug in better-call#129) produces a string value that the client treats as valid data, making the failure completely invisible — no error, no warning. With `strict: true`, the JSON parse error surfaces as an actual error, which the client query layer handles properly via `onError`. See: better-auth/better-call#129
roor0
added a commit
to roor0/better-auth
that referenced
this pull request
Apr 13, 2026
The client's JSON parser was configured with `strict: false`, which causes truncated JSON responses to be silently returned as raw strings instead of throwing an error. This means a response body truncated at a chunk boundary (e.g. due to the res.end() bug in better-call#129) produces a string value that the client treats as valid data, making the failure completely invisible — no error, no warning. With `strict: true`, the JSON parse error surfaces as an actual error, which the client query layer handles properly via `onError`. See: better-auth/better-call#129
Author
|
Closing — this is a duplicate of #124 which already addresses the same res.end() placement bug. Thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
setResponse()in the Node.js adapter callsres.end()inside the stream reading loop (after a successfulres.write()), causing the HTTP response to be terminated after the first chunk (~16KB). Any response body larger than one chunk is silently truncated, returning incomplete/malformed JSON to the client.This affects applications using better-auth's
customSessionplugin where the session payload exceeds 16KB (common with production user data containing assignments, projects, divisions, etc.). The client receives truncated JSON, parses it asnull, and the user appears unauthenticated.Root Cause
Fix
Move
res.end()after the loop:Test
Added a test that creates a response body larger than 16KB and verifies the full body is written to the Node.js response without truncation.