@lenne.tech/nest-server 11.42.10 → 11.42.12

package/src/core/modules/better-auth/core-better-auth-cookie.helper.ts

@@ -81,6 +81,16 @@ export interface BetterAuthCookieHelperConfig {
    * CRITICAL: Required for Passkey/2FA to work correctly.
    */
   secret?: string;
+  /**
+   * Whether Better-Auth's own handlers set `Secure` on the cookies they write
+   * (`CoreBetterAuthService.usesSecureCookies()`). `true` makes this helper set it too, whatever the
+   * environment, so one session cookie never carries two different transport rules.
+   *
+   * @since 11.42.12 Before, `secure` followed {@link isProductionLikeEnv} alone, so on the deployed
+   *                 `develop` / `test` stages of a starter-based project the cookie this helper wrote
+   *                 lacked `Secure` while Better-Auth's handlers set it on the same https deployment.
+   */
+  secureTransport?: boolean;
 }
 
 /**
@@ -146,9 +156,11 @@ export class BetterAuthCookieHelper {
   /**
    * Gets the default cookie options for authentication cookies.
    *
-   * The `secure` flag is `true` when either `config.env` is production-like
-   * (`production` / `staging`) or `NODE_ENV === 'production'`. This covers
-   * staging deployments where only one of the two signals is set.
+   * The `secure` flag is `true` when Better-Auth's own cookies are secure (`config.secureTransport`,
+   * i.e. an `https://` base URL unless the project opted out), when `config.env` is production-like
+   * (`production` / `staging`), or when `NODE_ENV === 'production'`. The first covers every https
+   * deployment whatever its environment name; the other two keep `Secure` where real users are
+   * certain even if a project switched it off in Better-Auth.
    *
    * @returns Cookie options with httpOnly, sameSite, and secure settings
    */
@@ -156,7 +168,7 @@ export class BetterAuthCookieHelper {
     const options: AuthCookieOptions = {
       httpOnly: true,
       sameSite: 'lax',
-      secure: isProductionLikeEnv(this.config.env),
+      secure: this.config.secureTransport === true || isProductionLikeEnv(this.config.env),
     };
 
     if (this.config.domain) {
@@ -403,7 +415,13 @@ export class BetterAuthCookieHelper {
  */
 export function createCookieHelper(
   basePath: string,
-  options?: { domain?: string; env?: string; legacyCookieEnabled?: boolean; secret?: string },
+  options?: {
+    domain?: string;
+    env?: string;
+    legacyCookieEnabled?: boolean;
+    secret?: string;
+    secureTransport?: boolean;
+  },
   logger?: Logger,
 ): BetterAuthCookieHelper {
   return new BetterAuthCookieHelper({
@@ -413,5 +431,6 @@ export function createCookieHelper(
     legacyCookieEnabled: options?.legacyCookieEnabled ?? false,
     logger,
     secret: options?.secret,
+    secureTransport: options?.secureTransport,
   });
 }

package/src/core/modules/better-auth/core-better-auth-email-verification.service.ts

@@ -4,7 +4,7 @@ import ejs = require('ejs');
 import * as fs from 'fs';
 import * as path from 'path';
 
-import { isProductionLikeEnv, resolveAppUrlFromConfig } from '../../common/helpers/cookies.helper';
+import { isLocalEnv, isProductionLikeEnv, resolveAppUrlFromConfig } from '../../common/helpers/cookies.helper';
 import { maskEmail } from '../../common/helpers/logging.helper';
 import { IBetterAuthEmailVerificationConfig } from '../../common/interfaces/server-options.interface';
 import { BrevoService } from '../../common/services/brevo.service';
@@ -838,25 +838,35 @@ export class CoreBetterAuthEmailVerificationService {
    * Print an auth link (verification / password reset) to stdout for local development.
    *
    * The URL embeds a bearer token: the verification link confirms an address, the reset link
-   * changes a password outright. Neither may reach a deployment holding real accounts, so the gate
-   * is `isProductionLikeEnv()` — the same two-layer check `EmailService` and the cookie helpers
-   * already use. `NODE_ENV !== 'production'` alone is NOT enough: a staging deployment sets
-   * `NODE_ENV=staging` so `getEnvironmentConfig()` loads its config block, which passes that test
-   * while holding real users.
+   * changes a password outright. Neither may reach a deployment's logs, so the link is printed only
+   * in a LOCAL environment (`isLocalEnv()`: `local`, `ci`, `e2e`) — an allowlist, not "anything
+   * that is not production". Until 11.42.12 the gate was `!isProductionLikeEnv()`, which names only
+   * `production` and `staging`; the deployed `develop` and `test` stages of a starter-based project
+   * passed it and wrote live reset links into their log pipeline, where log access alone was
+   * enough to take over an account.
+   *
+   * `LT_LOG_AUTH_URLS=1` opts in for another environment that runs on a developer machine (this
+   * repository's own `development`, for one); `LT_LOG_AUTH_URLS=0` suppresses it everywhere. A
+   * production-like environment never prints, whatever the variable says: the opt-in exists for
+   * laptops, and a hard floor keeps it from being the thing that reopens a deployment.
    *
    * The address is masked (PII, and the rest of this file already masks it); the URL is printed in
-   * full because following it without a mail server is the whole point locally. Set
-   * `LT_LOG_AUTH_URLS=0` to suppress it even outside production.
+   * full because following it without a mail server is the whole point locally.
    *
    * `console.log` rather than the NestJS logger, deliberately and for two reasons: the logger
    * buffers, which makes interception unreliable under Vitest, and a logger call would route the
    * token into `HubLogBufferService`'s ring buffer, which is readable over HTTP by any ADMIN.
    */
   protected logAuthUrlForDevelopment(label: string, email: string, url: string): void {
-    if (process.env.LT_LOG_AUTH_URLS === '0') {
+    const optIn = process.env.LT_LOG_AUTH_URLS;
+    if (optIn === '0') {
+      return;
+    }
+    const env = this.configService?.getFastButReadOnly<string>('env') ?? process.env.NODE_ENV;
+    if (isProductionLikeEnv(env)) {
       return;
     }
-    if (isProductionLikeEnv(this.configService?.getFastButReadOnly<string>('env'))) {
+    if (!isLocalEnv(env) && optIn !== '1') {
       return;
     }
     // oxlint-disable-next-line no-console

package/src/core/modules/better-auth/core-better-auth.controller.ts

@@ -268,6 +268,10 @@ export class CoreBetterAuthController {
         env: this.configService.getFastButReadOnly<string>('env'),
         legacyCookieEnabled: legacyAuthEnabled,
         secret: betterAuthConfig?.secret,
+        // Mirror Better-Auth's own `Secure` decision, so the cookie this controller writes and the
+        // one Better-Auth's handlers write follow the same transport rule on every https deployment.
+        // Optional call: a project's test stub of the service may predate the method.
+        secureTransport: this.betterAuthService.usesSecureCookies?.() === true,
       },
       this.logger,
     );

package/src/core/modules/better-auth/core-better-auth.service.ts

@@ -703,6 +703,30 @@ export class CoreBetterAuthService implements OnApplicationBootstrap, OnModuleIn
     return this.config.baseUrl || 'http://localhost:3000';
   }
 
+  /**
+   * Whether Better-Auth's own handlers set `Secure` on the cookies they write, read off the live
+   * instance.
+   *
+   * `createBetterAuthInstance()` pins `useSecureCookies: false` (for the cookie NAME) and restores
+   * the transport flag through `advanced.defaultCookieAttributes.secure` on an `https://` base URL;
+   * a project may override either. Reading the instance rather than re-deriving from a URL gives
+   * exactly the answer Better-Auth applies — including the base URL it actually uses, which
+   * {@link getBaseUrl} does not know when only the server's `baseUrl` is set.
+   *
+   * The framework's own cookie helper mirrors this, so a session cookie carries `Secure` no matter
+   * which path wrote it.
+   *
+   * @since 11.42.12
+   */
+  usesSecureCookies(): boolean {
+    const advanced = (
+      this.getInstance() as unknown as {
+        options?: { advanced?: { defaultCookieAttributes?: { secure?: unknown }; useSecureCookies?: unknown } };
+      } | null
+    )?.options?.advanced;
+    return advanced?.useSecureCookies === true || advanced?.defaultCookieAttributes?.secure === true;
+  }
+
   /**
    * Gets the resolved cookie domain for cross-subdomain cookie sharing.
    *