From 88c195f672e0fc8a975ea6b6c2a40f4ab2d88bec Mon Sep 17 00:00:00 2001
From: RainbowBird <git@luoling.moe>
Date: Sat, 28 Mar 2026 05:41:27 +0800
Subject: [PATCH] fix(server): better-auth cookie login

---
 apps/server/src/libs/auth.ts | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/apps/server/src/libs/auth.ts b/apps/server/src/libs/auth.ts
index 9b88c5d88..44673c180 100644
--- a/apps/server/src/libs/auth.ts
+++ b/apps/server/src/libs/auth.ts
@@ -43,6 +43,15 @@ export function createAuth(db: Database, env: Env, metrics?: AuthMetrics | null)
       },
     },
 
+    // NOTICE: Store OAuth state in the database instead of cookies to avoid
+    // state_mismatch errors on mobile browsers (iOS Safari/Chrome) where
+    // cross-site cookies are blocked by system-level privacy restrictions.
+    // https://github.com/better-auth/better-auth/issues/5892
+    // https://github.com/better-auth/better-auth/issues/6207
+    account: {
+      storeStateStrategy: 'database',
+    },
+
     socialProviders: {
       google: {
         clientId: env.AUTH_GOOGLE_CLIENT_ID,