From 25aa52ada37d713e981bff4a097976dec6b7cc52 Mon Sep 17 00:00:00 2001
From: Adrian Bonpin <adrianbonpin@gmail.com>
Date: Sun, 26 Apr 2026 19:44:37 +0800
Subject: [PATCH] fix: check specifically for session_token cookie, not all
 better-auth cookies

---
 proxy.ts | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/proxy.ts b/proxy.ts
index cb35657..93c402f 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -12,12 +12,14 @@ export function proxy(req: NextRequest) {
     const path = req.nextUrl.pathname
     const isAuthRoute = authRoutes.some((route) => path.startsWith(route))
 
-    // Check for better-auth session cookie (default name: better-auth.session_token)
+    // Check specifically for the session token cookie
+    // (better-auth.session_token or __Secure-better-auth.session_token in HTTPS)
+    // Other better-auth cookies like last_used_login_method persist after logout
     const hasSession = req.cookies
         .getAll()
         .some(
             (cookie) =>
-                cookie.name.startsWith("better-auth.") &&
+                cookie.name.endsWith("better-auth.session_token") &&
                 cookie.value.length > 0,
         )