Common Auth Domain for Multiple Hosts failing on Social Login with "Error Code: state_mismatch"

npm install better-auth@beta

npm install better-auth@beta

import { betterAuth } from "better-auth"
import { sso } from "@better-auth/sso"

export const auth = betterAuth({
  socialProviders: {
    google: {
      clientId: "YOUR_GOOGLE_CLIENT_ID",
      clientSecret: "YOUR_GOOGLE_CLIENT_SECRET",
      redirectURI: "https://your-domain.com/api/auth/callback/google"
    },
    discord: {
      clientId: "YOUR_DISCORD_CLIENT_ID",
      clientSecret: "YOUR_DISCORD_CLIENT_SECRET",
      redirectURI: "https://your-domain.com/api/auth/callback/discord"
    }
  },
  plugins: [
    sso({
      // optional additional SSO configuration options can go here
    })
  ]
})

import { betterAuth } from "better-auth"
import { sso } from "@better-auth/sso"

export const auth = betterAuth({
  socialProviders: {
    google: {
      clientId: "YOUR_GOOGLE_CLIENT_ID",
      clientSecret: "YOUR_GOOGLE_CLIENT_SECRET",
      redirectURI: "https://your-domain.com/api/auth/callback/google"
    },
    discord: {
      clientId: "YOUR_DISCORD_CLIENT_ID",
      clientSecret: "YOUR_DISCORD_CLIENT_SECRET",
      redirectURI: "https://your-domain.com/api/auth/callback/discord"
    }
  },
  plugins: [
    sso({
      // optional additional SSO configuration options can go here
    })
  ]
})

import { authClient } from "@/lib/auth-client";

await authClient.sso.register({
  providerId: "discord",
  issuer: "https://discord.com",
  domain: "discord.com",
  oidcConfig: {
    clientId: "YOUR_DISCORD_CLIENT_ID",
    clientSecret: "YOUR_DISCORD_CLIENT_SECRET",
    authorizationEndpoint: "https://discord.com/api/oauth2/authorize",
    tokenEndpoint: "https://discord.com/api/oauth2/token",
    // jwksEndpoint can be omitted if Discord does not provide it
    // discoveryEndpoint is also optional because Discord doesn't have a standard OIDC discovery document
    scopes: ["identify", "email"],
    pkce: true,
    mapping: {
      id: "id",
      email: "email",
      name: "username",
      image: "avatar"
    }
  }
});

import { authClient } from "@/lib/auth-client";

await authClient.sso.register({
  providerId: "discord",
  issuer: "https://discord.com",
  domain: "discord.com",
  oidcConfig: {
    clientId: "YOUR_DISCORD_CLIENT_ID",
    clientSecret: "YOUR_DISCORD_CLIENT_SECRET",
    authorizationEndpoint: "https://discord.com/api/oauth2/authorize",
    tokenEndpoint: "https://discord.com/api/oauth2/token",
    // jwksEndpoint can be omitted if Discord does not provide it
    // discoveryEndpoint is also optional because Discord doesn't have a standard OIDC discovery document
    scopes: ["identify", "email"],
    pkce: true,
    mapping: {
      id: "id",
      email: "email",
      name: "username",
      image: "avatar"
    }
  }
});

await auth.api.registerSSOProvider({
  body: {
    // A unique identifier for your provider configuration
    providerId: "google-sso",
    // Google's OIDC issuer URL for authentication
    issuer: "https://accounts.google.com",
    // Optional: define the domain or any additional settings if necessary
    domain: "yourdomain.com",
    // You can also include any additional properties required by your configuration,
    // such as clientId or clientSecret if your implementation requires it.
    // clientId: process.env.GOOGLE_CLIENT_ID,
    // clientSecret: process.env.GOOGLE_CLIENT_SECRET,
  },
  // Include any headers required for authentication or content type if necessary
  headers: {
    "Content-Type": "application/json"
  }
});

await auth.api.registerSSOProvider({
  body: {
    // A unique identifier for your provider configuration
    providerId: "google-sso",
    // Google's OIDC issuer URL for authentication
    issuer: "https://accounts.google.com",
    // Optional: define the domain or any additional settings if necessary
    domain: "yourdomain.com",
    // You can also include any additional properties required by your configuration,
    // such as clientId or clientSecret if your implementation requires it.
    // clientId: process.env.GOOGLE_CLIENT_ID,
    // clientSecret: process.env.GOOGLE_CLIENT_SECRET,
  },
  // Include any headers required for authentication or content type if necessary
  headers: {
    "Content-Type": "application/json"
  }
});

{
  "providerId": "google",
  "issuer": "https://accounts.google.com",
  "domain": "yourcompany.com",
  "oidcConfig": {
    "clientId": "YOUR_GOOGLE_CLIENT_ID",
    "clientSecret": "YOUR_GOOGLE_CLIENT_SECRET",
    "discoveryEndpoint": "https://accounts.google.com/.well-known/openid-configuration",
    "pkce": true,
    "scopes": ["openid", "email", "profile"],
    "mapping": {
      "id": "sub",
      "email": "email",
      "name": "name",
      "image": "picture"
    }
  }
}

{
  "providerId": "google",
  "issuer": "https://accounts.google.com",
  "domain": "yourcompany.com",
  "oidcConfig": {
    "clientId": "YOUR_GOOGLE_CLIENT_ID",
    "clientSecret": "YOUR_GOOGLE_CLIENT_SECRET",
    "discoveryEndpoint": "https://accounts.google.com/.well-known/openid-configuration",
    "pkce": true,
    "scopes": ["openid", "email", "profile"],
    "mapping": {
      "id": "sub",
      "email": "email",
      "name": "name",
      "image": "picture"
    }
  }
}

// backend setup
import {betterAuth} from "better-auth";
import { mongodbAdapter } from "better-auth/adapters/mongodb";
import { db } from "./BetterAuthDB.js";
import 'dotenv/config'
import {customSession} from "better-auth/plugins";

export const auth = betterAuth({
    database: mongodbAdapter(db),
    socialProviders: {
        google:{
            prompt: "select_account",
            clientId:process.env.GOOGLE_CLIENT_ID,
            clientSecret: process.env.GOOGLE_CLIENT_SECRET,
            redirectURI:process.env.REDIRECT_URI
        },
    },
    trustedOrigins: [
    process.env.SERVER, // backend
    process.env.CLIENT, // frontend
  ],
  session:{
    expiresIn: 60*60*24*7,
    updateAge: 60*15,

    cookieCache: {
            enabled: true,
            maxAge: 5 * 60 
  }
},
advanced: {
  useSecureCookies: process.env.NODE_ENV === "production",
  cookies: {
    session_token: {
      attributes: {
        sameSite: "none",
        secure: true,
      },
    },
    oauth_state: {
      attributes: {
        sameSite: "none",
        secure: true,
      },
    },
  },
},
  plugins:[
    customSession(async({user})=>{
      return {
        user: user
      }
    })
  ]

})

// backend setup
import {betterAuth} from "better-auth";
import { mongodbAdapter } from "better-auth/adapters/mongodb";
import { db } from "./BetterAuthDB.js";
import 'dotenv/config'
import {customSession} from "better-auth/plugins";

export const auth = betterAuth({
    database: mongodbAdapter(db),
    socialProviders: {
        google:{
            prompt: "select_account",
            clientId:process.env.GOOGLE_CLIENT_ID,
            clientSecret: process.env.GOOGLE_CLIENT_SECRET,
            redirectURI:process.env.REDIRECT_URI
        },
    },
    trustedOrigins: [
    process.env.SERVER, // backend
    process.env.CLIENT, // frontend
  ],
  session:{
    expiresIn: 60*60*24*7,
    updateAge: 60*15,

    cookieCache: {
            enabled: true,
            maxAge: 5 * 60 
  }
},
advanced: {
  useSecureCookies: process.env.NODE_ENV === "production",
  cookies: {
    session_token: {
      attributes: {
        sameSite: "none",
        secure: true,
      },
    },
    oauth_state: {
      attributes: {
        sameSite: "none",
        secure: true,
      },
    },
  },
},
  plugins:[
    customSession(async({user})=>{
      return {
        user: user
      }
    })
  ]

})

// frontend

import { createAuthClient } from "better-auth/react"
export const authClient = createAuthClient({
    baseURL: `${import.meta.env.VITE_SERVER}/api/auth`,
    fetchOptions: {
    credentials: "include"
  }
})



export const { signIn, signUp, useSession, signOut } = authClient

// frontend

import { createAuthClient } from "better-auth/react"
export const authClient = createAuthClient({
    baseURL: `${import.meta.env.VITE_SERVER}/api/auth`,
    fetchOptions: {
    credentials: "include"
  }
})



export const { signIn, signUp, useSession, signOut } = authClient

import { betterAuth, Auth } from 'better-auth';
import { betterAuthConfig } from '@/config/better-auth.config';

import {
    bearer,
    openAPI,
} from 'better-auth/plugins';
// import { sso } from '@better-auth/sso';

import { typeormAdapter } from '@hedystia/better-auth-typeorm';

import { dataSource } from '@/database/data-source';
import { discordConfig } from '@/config/discord.config';
import { googleConfig } from '@/config/google.config';
import { checkOrigin } from '@/utils/cors/check-origin';

import { Stack } from '@/types/stack';
const moduleStack = new Stack(import.meta);

export const auth: Auth = betterAuth({
    baseURL: betterAuthConfig.baseUrl,
    basePath: betterAuthConfig.basePath,
    secret: betterAuthConfig.secret,

    advanced: {
        defaultCookieAttributes: {
            sameSite: 'none',
            secure: true,
        },
        oauthConfig: {
            skipStateCookieCheck: true,
        },
    },

    database: typeormAdapter(dataSource),

    plugins: [
        bearer(),
        // sso(),
        openAPI({
            path: 'openapi',
            theme: 'bluePlanet',
        }),
    ],

    socialProviders: {
        discord: {
            clientId: discordConfig.clientId,
            clientSecret: discordConfig.clientSecret,
        },
        google: {
            clientId: googleConfig.clientId,
            clientSecret: googleConfig.clientSecret,
        },
    },

    trustedOrigins: async ({ headers }) => {
        const stack = moduleStack.here('trustedOrigins');
        stack.debug('Checking origin');

        const result = await checkOrigin(headers);
        stack.debug('Origin check result', result);

        if (result.trustedOrigin) {
            return [result.trustedOrigin];
        }

        return [];
    },
});

import { betterAuth, Auth } from 'better-auth';
import { betterAuthConfig } from '@/config/better-auth.config';

import {
    bearer,
    openAPI,
} from 'better-auth/plugins';
// import { sso } from '@better-auth/sso';

import { typeormAdapter } from '@hedystia/better-auth-typeorm';

import { dataSource } from '@/database/data-source';
import { discordConfig } from '@/config/discord.config';
import { googleConfig } from '@/config/google.config';
import { checkOrigin } from '@/utils/cors/check-origin';

import { Stack } from '@/types/stack';
const moduleStack = new Stack(import.meta);

export const auth: Auth = betterAuth({
    baseURL: betterAuthConfig.baseUrl,
    basePath: betterAuthConfig.basePath,
    secret: betterAuthConfig.secret,

    advanced: {
        defaultCookieAttributes: {
            sameSite: 'none',
            secure: true,
        },
        oauthConfig: {
            skipStateCookieCheck: true,
        },
    },

    database: typeormAdapter(dataSource),

    plugins: [
        bearer(),
        // sso(),
        openAPI({
            path: 'openapi',
            theme: 'bluePlanet',
        }),
    ],

    socialProviders: {
        discord: {
            clientId: discordConfig.clientId,
            clientSecret: discordConfig.clientSecret,
        },
        google: {
            clientId: googleConfig.clientId,
            clientSecret: googleConfig.clientSecret,
        },
    },

    trustedOrigins: async ({ headers }) => {
        const stack = moduleStack.here('trustedOrigins');
        stack.debug('Checking origin');

        const result = await checkOrigin(headers);
        stack.debug('Origin check result', result);

        if (result.trustedOrigin) {
            return [result.trustedOrigin];
        }

        return [];
    },
});

import { createAuthClient } from 'better-auth/react';
import { authConfig } from '@/config/auth.config';

console.log('authConfig.BaseUrl', authConfig.BaseUrl);

export const authClient = createAuthClient({
  auth: {
    type: 'Bearer',
    token: () => localStorage.getItem('bearer_token') || '',
  },

  baseUrl: authConfig.BaseUrl,
  basePath: authConfig.BasePath,

  fetchOptions: {
    credentials: 'include',
    onSuccess: (context) => {
      const authToken = context.response.headers.get('set-auth-token');
      console.log('authClient -> fetchOptions -> onSuccess -> authToken:', authToken);

      // Store the token securely (e.g., in localStorage)
      if (authToken) {
        localStorage.setItem('bearer_token', authToken);
      }
    },
  },
});

export type Session = typeof authClient.$Infer.Session;

import { createAuthClient } from 'better-auth/react';
import { authConfig } from '@/config/auth.config';

console.log('authConfig.BaseUrl', authConfig.BaseUrl);

export const authClient = createAuthClient({
  auth: {
    type: 'Bearer',
    token: () => localStorage.getItem('bearer_token') || '',
  },

  baseUrl: authConfig.BaseUrl,
  basePath: authConfig.BasePath,

  fetchOptions: {
    credentials: 'include',
    onSuccess: (context) => {
      const authToken = context.response.headers.get('set-auth-token');
      console.log('authClient -> fetchOptions -> onSuccess -> authToken:', authToken);

      // Store the token securely (e.g., in localStorage)
      if (authToken) {
        localStorage.setItem('bearer_token', authToken);
      }
    },
  },
});

export type Session = typeof authClient.$Infer.Session;