new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Better Auth · Authentication · all subjects

sessions and account linking

7 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Prevent duplicate session requests during React retries

Duplicate in-flight session requests are deduplicated when React retries a suspended component, and session refresh no longer emits duplicate /get-session requests from focus and other browser session events.

getCookieCache returns null for expired session

getCookieCache now returns null for an expired session instead of the stale session data. Middleware that calls it to gate access no longer treats an expired signed cookie as a live session.

Deleted session immediately rejected by update and account endpoints

Deleting a session now immediately stops /update-session and the account token endpoints (/get-access-token, /refresh-token, /account-info) from accepting it when cookie cache is enabled alongside a database or secondary storage. Before, these routes kept serving the deleted session from the cached cookie until the cache expired.

Multi-session set-active and revoke endpoints require matching cookie

The multi-session set-active and revoke endpoints now act only on the session the caller holds a signed cookie for. A request could previously activate or revoke a different session by naming its token in the request body without holding that session's cookie.

Refresh-token endpoint validates account cookie match

Require /refresh-token to only trust the account cookie when its userId, providerId and (when supplied) accountId match the resolved session user.

Session refreshes preserve OAuth account cookie

Stateless OAuth deployments can now read account info, access tokens, and refresh tokens after different server instances handle sign-in and later requests. Session refresh also keeps the OAuth account cookie instead of clearing it in that case.

Session cookie cache near size limit is chunked

Session and account cache cookies near the browser's per-cookie size limit (for example with a long cookiePrefix or many cached fields) are now split into chunks instead of being silently dropped by the browser. A cache too large to fit even when chunked is skipped with a warning rather than failing the request.

Give your agent this brain