[mroderick]

Logout now asks better-auth for the signOut response and appends its Set-Cookie values to the redirect, so no code in this repo decides how cookies are forwarded. forwardCookies and src/app/utils/cookies.js are gone.

const signOut = await auth.api.signOut({
  headers: c.req.raw.headers,
  asResponse: true,
});
if (!signOut.ok) {
  console.error(`Logout failed with status ${signOut.status}`);
  return signOut;
}
const response = c.redirect(callbackURL);
for (const cookie of signOut.headers.getSetCookie()) {
  response.headers.append("Set-Cookie", cookie);
}
return response;

Why this over #103

#103 fixed the symptom: c.header("Set-Cookie", ...) replaces instead of appending, so two of the three clearing cookies vanished. It kept the hand-rolled copy loop and passed { append: true }.

This removes the class of bug instead of fixing an instance of it:

• Nothing local inspects or rewrites Set-Cookie. The values go from the better-auth Response onto the redirect Response untouched, and Response.headers.append is the transport-level operation rather than a framework context helper with its own semantics.
• No cookie names appear in the code. signOut decides which cookies to clear; adding or renaming one cannot desynchronise a local list.
• asResponse: true is better-auth's own API, so the number of cookies is whatever better-auth returns. If a future version clears four, all four arrive.

Why not a better-auth helper

There is none for this direction. better-auth/cookies exports applySetCookies and setCookieToHeader, but both write a request cookie header: applySetCookies ends in target.set("cookie", ...), and inside better-auth the only consumer of setCookieToHeader is the test harness, as cookieSetter. splitSetCookieHeader only splits a comma-joined header. Cookie-name constants do exist (getCookies(auth.options)), but this code needs none.

Equivalence

The #103 tests are unchanged and pass, and the /logout response is byte-identical between the two implementations:

better-auth.session_token=; Max-Age=0; Path=/; HttpOnly; SameSite=Lax
better-auth.session_data=; Max-Age=0; Path=/; HttpOnly; SameSite=Lax
better-auth.dont_remember=; Max-Age=0; Path=/; HttpOnly; SameSite=Lax

One test is added, for the failure path described below.

Review notes

asResponse: true also changes error handling, which is the part worth checking. better-auth throws an APIError when an endpoint fails, but with asResponse it returns an error Response with that status instead (node_modules/better-auth/dist/api/dispatch.mjs:193,249,258). Without a status check, logout would redirect to /?message=Bye! after a failed sign-out while the session still stood. The handler returns the failure instead, and the new test covers it by injecting an auth instance whose signOut answers 500.

Outside error responses the call always resolves to a Response: signOut returned 200 with all three clearing cookies for a valid session, a bogus session token, and no session at all.

Scope: based on test/cookie-attributes, so it carries #103's tests and shows only the mechanism change. Take this one or #103, not both. If this lands, #104's forwardCookies test loses its subject and should be dropped with it.

[till]

This is great, @mroderick! :)