Express 5 `/*path` Pattern Causes 404 on All Auth Routes

[Brainisthekey]

When using @thallesp/nestjs-better-auth@2.2.0 with Express 5 (via @nestjs/platform-express@11.x), all Better Auth routes return 404. This is caused by Express 5's wildcard pattern /*path behavior combined with how better-call constructs request URLs.

Environment

Package	Version
@thallesp/nestjs-better-auth	2.2.0
better-auth	1.4.6
better-call	1.1.5
@nestjs/core	11.1.9
@nestjs/common	11.1.9
@nestjs/platform-express	11.1.9
express	5.1.0

The Problem

Root Cause

In nestjs-better-auth, the auth handler is mounted using:

// From dist/index.cjs line 322
this.adapter.httpAdapter.getInstance().use(`${basePath}/*path`, (req, res) => {
  // ...
  return handler(req, res);
});

With Express 5's /*path wildcard pattern, the request properties are set as:

• req.url = / (just a slash)
• req.baseUrl = /api/auth/sign-in/social (the FULL matched path)
• req.originalUrl = /api/auth/sign-in/social

How better-call Handles This

In better-call@1.1.5 (file: node.js), the URL is constructed as:

function getRequest({ request, base, bodySizeLimit }) {
  const baseUrl = request?.baseUrl;
  const fullPath = baseUrl ? baseUrl + request.url : request.url;
  // ...
  return new Request(base + fullPath, { ... });
}

This results in: baseUrl + url = /api/auth/sign-in/social + / = /api/auth/sign-in/social/

The trailing slash causes Better Auth to not recognize the route, returning 404.

Expected Behavior (Express 4 / Without Wildcard)

With app.use('/api/auth', handler) (no wildcard):

• req.url = /sign-in/social
• req.baseUrl = /api/auth
• Result: /api/auth + /sign-in/social = /api/auth/sign-in/social (correct!)

Proof of Concept

Adding debug logging confirms the issue:

this.adapter.httpAdapter.getInstance().use(`${basePath}/*path`, (req, res) => {
  console.log(`req.url=${req.url} | req.baseUrl=${req.baseUrl} | req.originalUrl=${req.originalUrl}`);
  // ...
});

Output:

req.url=/ | req.baseUrl=/api/auth/sign-in/social | req.originalUrl=/api/auth/sign-in/social

Current Workaround

Using the middleware option to fix the URL before the handler runs:

// auth.module.ts
import { Module } from "@nestjs/common";
import { AuthModule as BetterAuthModule } from "@thallesp/nestjs-better-auth";
import { auth } from "./auth";

@Module({
  imports: [
    BetterAuthModule.forRoot({
      auth,
      // Fix for Express 5: The /*path pattern sets req.url=/ and req.baseUrl=full_path
      // better-call concatenates baseUrl+url creating a trailing slash that causes 404
      // This middleware restores req.url to the full path before the handler runs
      middleware: (req, _res, next) => {
        req.url = req.originalUrl;
        req.baseUrl = "";
        next();
      },
    }),
  ],
  exports: [BetterAuthModule],
})
export class AuthModule {}

Better Auth Configuration (for reference)

// auth.ts
import { betterAuth } from "better-auth";
import { prismaAdapter } from "better-auth/adapters/prisma";
import { PrismaClient } from "@app/database/generated/prisma";
import { env } from "../config/env.config";

const prisma = new PrismaClient();

export const auth = betterAuth({
  baseURL: env.auth.betterAuthUrl,
  database: prismaAdapter(prisma, {
    provider: "postgresql",
    transaction: true,
  }),
  socialProviders: {
    google: {
      clientId: env.auth.googleClientId,
      clientSecret: env.auth.googleClientSecret,
      scope: ["email", "profile"],
    },
  },
  session: {
    expiresIn: 60 * 60 * 24 * 7, // 7 days
    updateAge: 60 * 60 * 24, // 1 day
    cookieCache: {
      enabled: true,
      maxAge: 5 * 60, // Cache for 5 minutes
    },
  },
  trustedOrigins: [env.auth.betterAuthUrl, env.web.url],
});

Related Issues

• nestjs-better-auth #20 - /api/auth/* always return 404
• nestjs-better-auth #25 - Closed as "configuration issue" but the root cause is the /*path pattern
• better-auth #3887 - Express subrouter 404 issue (FIXED in better-call)
• better-call #32 - Node mount path fix (merged, but doesn't fix /*path pattern issue)

Notes

• The better-call fix (PR Support for Database Hooks? #32) assumes req.baseUrl is the mount point and req.url is the remaining path
• Express 5's /*path pattern violates this assumption by putting the FULL path in req.baseUrl
• The official Better Auth Express docs suggest using /*splat for Express 5, not /*path

[TheMichio]

@Brainisthekey Hi 👋

I'm facing this issue but the middleware workaround does not work for me, I have the same package versions as you.

@ThallesP can you please help us with this issue?

with a new nestjs project, auth routes returns 404.

[awwoken]

@TheMichio, ensure that you place the middleware property outside of the betterAuth({…}) call. The middleware parameter is module-specific, not the betterAuth client. TypeScript doesn’t complain about placing middleware inside the betterAuth call, even though it’s incorrect.

[laakal]

I can confirm this behavior.

With:

• @thallesp/nestjs-better-auth@2.2.0
• better-auth@1.4.6

all Better Auth routes return 404 as described.

When I downgrade only better-auth to 1.4.5 (keeping @thallesp/nestjs-better-auth@2.2.0 the same), everything works again without needing any extra middleware workaround. So this looks like a regression introduced in better-auth@1.4.6 (or the dependencies/URL handling that changed with that release).

Temporary workaround:
Pin better-auth to 1.4.5 in package.json:

"dependencies": {
  "better-auth": "1.4.5",
  "@thallesp/nestjs-better-auth": "2.2.0"
}

then reinstall dependencies.

[mahmoude4477]

1.4.5

thank you, i took 14H to try solve it

[picardplaisimond]

I can confirm this behavior.

With:

* `@thallesp/nestjs-better-auth@2.2.0`

* `better-auth@1.4.6`

all Better Auth routes return 404 as described.

When I downgrade only better-auth to 1.4.5 (keeping @thallesp/nestjs-better-auth@2.2.0 the same), everything works again without needing any extra middleware workaround. So this looks like a regression introduced in better-auth@1.4.6 (or the dependencies/URL handling that changed with that release).

Temporary workaround: Pin better-auth to 1.4.5 in package.json:

"dependencies": {
"better-auth": "1.4.5",
"@thallesp/nestjs-better-auth": "2.2.0"
}

then reinstall dependencies.

I love you so much that I would give you a kiss ! I lost so much time on this. thank you !
It's weird that we didn't have any errors other than that a 404. It was super hard to debug.

EDIT: This was my last straw. I'm moving to Hono. The NestJS ecosystem has become a pain to maintain.

[Arutowk]

add these codes to solve in better-auth@1.4.6
better-auth issue link

//main.ts
import { toNodeHandler } from 'better-auth/node';

bootstrap (){
...
  const express = app.getHttpAdapter().getInstance();
  express.all(/^\/api\/auth\/.*$/, toNodeHandler(auth));
...
}

[JosChavz]

I can confirm this behavior.

With:

• @thallesp/nestjs-better-auth@2.2.0
• better-auth@1.4.6

all Better Auth routes return 404 as described.

When I downgrade only better-auth to 1.4.5 (keeping @thallesp/nestjs-better-auth@2.2.0 the same), everything works again without needing any extra middleware workaround. So this looks like a regression introduced in better-auth@1.4.6 (or the dependencies/URL handling that changed with that release).

Temporary workaround: Pin better-auth to 1.4.5 in package.json:

"dependencies": {
"better-auth": "1.4.5",
"@thallesp/nestjs-better-auth": "2.2.0"
}
then reinstall dependencies.

Worked! ;-;

[onesamket]

@laakal thanks man!

[aaryaparadkar]

@Arutowk you just saved my ass man, thanks a lot!

[maxdevos49]

Dug into this and the issue is rooted in the better-call package not handling the differences between method routes and mounted middlewares. You can see the differences with this basic express.js app:

// Run with: node app.js

const express = require("express");
const app = express();
const port = 3000;

// Note: *splat or *path is irrelevant for wildcard paths. The string is just
// used for lookups in `req.params`

/** @param {import("express").Request} req */
function result(req) {
  return {
    originalUrl: req.originalUrl,
    url: req.url,
    baseUrl: req.baseUrl,
    params: req.params,
    // better-call request url normalization for better-call:v1.1.7 used by better-auth:1.4.9 (latest at time of writing)
    // Refer to:
    // https://github.com/better-auth/better-call/blob/v1.1.7/src/adapters/node/request.ts#L102
    betterCallRequestURL: req.baseUrl ? req.baseUrl + req.url : req.url,
  };
}

app.get("/some/route", (req, res) => {
  // {
  //   "originalUrl": "/some/route",
  //   "url": "/some/route",
  //   "baseUrl": "",
  //   "params": { },
  //   "betterCallRequestURL": "/some/route"
  // }
  res.json(result(req)); // betterCallRequestURL is correct!
});

app.get("/some/route/*splat", (req, res) => {
  // {
  //   "originalUrl": "/some/route/matched",
  //   "url": "/some/route/matched",
  //   "baseUrl": "",
  //   "params": {
  //     "splat": [ "matched" ]
  //   },
  //   "betterCallRequestURL": "/some/route/matched"
  // }
  res.json(result(req)); // betterCallRequestURL is correct!
});

// Now a middleware handler

app.use("/api/auth/*path", (req, res) => {
  // {
  // "originalUrl": "/api/auth/matched",
  // "url": "/",
  // "baseUrl": "/api/auth/matched",
  // "params": {
  //     "path": [ "matched" ]
  // },
  // "betterCallRequestURL": "/api/auth/matched/"
  // }
  return res.json(result(req)); // betterCallRequestURL is wrong!
});

app.listen(port, () => {
  console.log(`Server listening at http://localhost:${port}`);
});

A change in better-call here to just use req.originalUrl should fix the issue as req.originalUrl is never rewritten if its a mounted middleware.

[prasannakarki77]

I can confirm this behavior.

With:

* `@thallesp/nestjs-better-auth@2.2.0`

* `better-auth@1.4.6`

all Better Auth routes return 404 as described.

When I downgrade only better-auth to 1.4.5 (keeping @thallesp/nestjs-better-auth@2.2.0 the same), everything works again without needing any extra middleware workaround. So this looks like a regression introduced in better-auth@1.4.6 (or the dependencies/URL handling that changed with that release).

Temporary workaround: Pin better-auth to 1.4.5 in package.json:

"dependencies": {
"better-auth": "1.4.5",
"@thallesp/nestjs-better-auth": "2.2.0"
}

then reinstall dependencies.

This worked. Thanks

[ThallesP]

i guess this is now fixed under v.2.2.2, can anyone confirm?

[JMBodz]

Is the Auth routes shown in the swagger docs? I also tried to access the routes using postman and it shows not found

[kms0219kms]

@ThallesP still happening with ^2.4.0