From dfbc5d61d6429f8feaab4ba769b6be5e0731c238 Mon Sep 17 00:00:00 2001
From: Adrian Bonpin <adrianbonpin@gmail.com>
Date: Sun, 26 Apr 2026 19:49:26 +0800
Subject: [PATCH] fix: validate session server-side in proxy to prevent stale
 cookie redirect loops

---
 proxy.ts | 25 ++++++++++++-------------
 1 file changed, 12 insertions(+), 13 deletions(-)

diff --git a/proxy.ts b/proxy.ts
index 93c402f..039aeea 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server"
 import type { NextRequest } from "next/server"
+import { auth } from "@/lib/auth"
 
 const authRoutes = [
     "/login",
@@ -8,23 +9,21 @@ const authRoutes = [
     "/reset-password",
 ]
 
-export function proxy(req: NextRequest) {
+export async function proxy(req: NextRequest) {
     const path = req.nextUrl.pathname
     const isAuthRoute = authRoutes.some((route) => path.startsWith(route))
 
-    // Check specifically for the session token cookie
-    // (better-auth.session_token or __Secure-better-auth.session_token in HTTPS)
-    // Other better-auth cookies like last_used_login_method persist after logout
-    const hasSession = req.cookies
-        .getAll()
-        .some(
-            (cookie) =>
-                cookie.name.endsWith("better-auth.session_token") &&
-                cookie.value.length > 0,
-        )
+    if (!isAuthRoute) {
+        return NextResponse.next()
+    }
 
-    // Redirect authenticated users away from auth pages
-    if (isAuthRoute && hasSession) {
+    // Validate session server-side instead of just checking cookie existence.
+    // This prevents stale cookies from causing redirect loops.
+    const session = await auth.api.getSession({
+        headers: req.headers,
+    })
+
+    if (session) {
         return NextResponse.redirect(new URL("/", req.url))
     }