appendAuthHeaders throws on immutable dev-asset responses #308

https://discord.com/channels/1475973262193459293/1479410313530179676/1545171663220645938

Bug report

Title: appendAuthHeaders throws "Can't modify immutable headers" on Vite
dev-asset responses, blanking pages-mode apps with auth enabled

Version: void@0.10.13 (dev server; vite dev via Vite+)

Summary: With defineAuth enabled in a pages-mode app, the dev server
returns 500 for Vite's own asset responses (/@vite/client, /@id/…,
/@fs/…, HMR modules) because appendAuthHeaders calls target.set(...) on
a Response whose headers are immutable. Every page renders blank in dev.
Reproduces with zero plugins — a fresh void init + defineAuth with
emailAndPassword is enough.

Where: dist/better-auth-shared-*.mjs

js function appendAuthHeaders(target, source) { if (!source) return; source.forEach((value, key) => { if (key.toLowerCase() === "set-cookie") { target.append(key, value); // throws on immutable headers return; } target.set(key, value); // throws on immutable headers }); }

Repro:

1. npx void init (pages mode, React), add defineAuth(({ defaults }) => ({ ...defaults, emailAndPassword: { enabled: true } })).
2. vp dev, open /.
3. Console: TypeError: Can't modify immutable headers. from appendAuthHeaders; the page body is empty because /@vite/client returned 500.

Suggested fix: guard the header writes — auth headers are irrelevant on
asset responses, and dropping them beats failing the whole request:

js source.forEach((value, key) => { try { if (key.toLowerCase() === "set-cookie") { target.append(key, value); return; } target.set(key, value); } catch { // immutable response headers (Vite dev asset responses in pages mode) } });