Arcjet / Better Auth integration

[giscus[bot]]

Arcjet / Better Auth integration

Integrating Better Auth and Arcjet. Add bot protection and spam signup protection to Better Auth endpoints.

https://docs.arcjet.com/integrations/better-auth

[fthong985]

i encountered a trouble with better-auth

ERROR [Better Auth]: TypeError TypeError: Body is unusable: Body has already been read

[davidmytton]

If you can share your code @fthong985 then we can check what might be happening.

[fthong985]

I tried it and copied the example for the Better Auth integration above, but for some reason it’s gone. It’s kinda weird — it works fine, then randomly throws an error. I installed Arcjet v1.0.0-beta-17 for now, and I haven’t run into it yet.

Nextjs 16.1.4
better-auth 1.4.17

this code is actually came from the example of better-auth integration:

const aj = arcjet({
  key: process.env.ARCJET_KEY!, 
  characteristics: ["userId"],
  rules: [

    shield({
      mode: "LIVE", 
    }),
  ],
});

//* EMAIL OPTION
const emailOptions = {
  mode: "LIVE", 

  deny: ["DISPOSABLE", "INVALID", "NO_MX_RECORDS"],
} satisfies EmailOptions;

//* BOT OPTION
const botOptions = {
  mode: "LIVE",

  allow: [], 
} satisfies BotOptions;

//* RESTRICTIVE RATE LIMIT SETTINGS
const restrictiveRateLimitSettings = {
  mode: "LIVE",
  max: 5,
  interval: "10m",
} satisfies SlidingWindowRateLimitOptions<[]>;

//* LAX RATE LIMIT SETTINGS
const laxRateLimitSettings = {
  mode: "LIVE",
  max: 60,
  interval: "1m",
} satisfies SlidingWindowRateLimitOptions<[]>;

//* SIGN UP OPTIONS
const signupOptions = {
  email: emailOptions,

  bots: botOptions,

  rateLimit: restrictiveRateLimitSettings,
} satisfies ProtectSignupOptions<[]>;

//* PROTECT FUNCTION
async function protect(req: NextRequest): Promise<ArcjetDecision> {
  const session = await auth.api.getSession({
    headers: req.headers,
  });

  let userId: string;
  if (session?.user.id) {
    userId = session.user.id;
  } else {
    userId = findIp(req) || "127.0.0.1"; 
  }


  if (
    req.nextUrl.pathname.startsWith("/api/auth/sign-up") ||
    req.nextUrl.pathname.startsWith("/api/auth/request-password-reset")
  ) {
    const body = await req.clone().json();

    if (typeof body.email === "string") {
      return aj
        .withRule(protectSignup(signupOptions))
        .protect(req, { email: body.email, userId });
    } else {
      return aj
        .withRule(detectBot(botOptions))
        .withRule(slidingWindow(restrictiveRateLimitSettings))
        .protect(req, { userId });
    }
  } else {
    // For all other auth requests
    return aj
      .withRule(detectBot(botOptions))
      .withRule(slidingWindow(laxRateLimitSettings))
      .protect(req, { userId });
  }
}

const authHandlers = toNextJsHandler(auth.handler);

export const { GET } = authHandlers;

//* CUSTOM POST REQUEST (BETTER AUTH)
export const POST = async (req: NextRequest) => {
  const decision = await protect(req);

  if (decision.isDenied()) {
    if (decision.reason.isRateLimit()) {
      return Response.json(
        { message: "Too many request. Please try again later" },
        { status: 429 },
      );
    } else if (decision.reason.isEmail()) {
      let message: string;

      if (decision.reason.emailTypes.includes("INVALID")) {
        message = "Email address format is invalid. Check if there's a typo";
      } else if (decision.reason.emailTypes.includes("DISPOSABLE")) {
        message = "We do not allow disposable email addresses.";
      } else if (decision.reason.emailTypes.includes("NO_MX_RECORDS")) {
        message =
          "Your email domain does not have an MX record. Check if there's a typo";
      } else {

        message = "Invalid email. Please try another one";
      }

      return Response.json({ message }, { status: 400 });
    } else {
      return Response.json(null, { status: 403 });
    }
  }

  return authHandlers.POST(req);
};

[davidmytton]

It looks like something has already read the body when you call const body = await req.clone().json();. There's no difference between beta-17 and 1.0.0 in terms of the body handling so I suspect this is coming from another area of your codebase.

[fthong985]

Just an update, I haven’t encountered it again since I also cloned the request and passed it directly to authHandler.post() in the Better Auth custom POST request.

const authHandlers = toNextJsHandler(auth.handler);

export const { GET } = authHandlers;

//* CUSTOM POST REQUEST (BETTER AUTH)
export const POST = async (req: NextRequest) => {
  const decision = await protect(req);

  if (decision.isDenied()) return handleDenied(decision);

  return authHandlers.POST(req.clone());
};

[davidmytton]

Great, thanks for confirming @fthong985 - let us know if you hit any other issues!

[ghost]

Hey, the Nextjs + Better Auth implementation can't be found on GitHub.

[davidmytton]

We've removed the better auth example for now, but you can find it in the repo history here: https://github.com/arcjet/arcjet-js/tree/6664747c7a8e783f9f6b7f33e64364727234c02d/examples/nextjs-better-auth

[IeRhem]

Yoo..., the Nextjs + Better Auth implementation example can't be found on GitHub.

[davidmytton]

We've removed the better auth example for now, but you can find it in the repo history here: https://github.com/arcjet/arcjet-js/tree/6664747c7a8e783f9f6b7f33e64364727234c02d/examples/nextjs-better-auth

[IeRhem]

thank you

[pritom004]

I created a Better Auth + Arcjet integration Gist.
You can check it out here: https://gist.github.com/pritom004/2ff7bf94e7de1ddde89af4bcdf230ce1
Let me know your feedback!

[amankatwal]

Repository examples/nextjs-better-auth. does not exists