improvement(auth): bump better-auth to 1.6.23 and add trusted-proxy client IP resolution (#5857)

* improvement(auth): bump better-auth to 1.6.23 and add trusted-proxy client IP resolution

* chore(billing): record checkout-scope mirror re-verification against @better-auth/stripe 1.6.23

* chore(deploy): expose AUTH_TRUSTED_PROXIES in docker-compose.prod and Helm chart

Author: waleedlatif1

apps/sim/.env.example

@@ -19,6 +19,7 @@ BETTER_AUTH_URL=http://localhost:3000
 NEXT_PUBLIC_APP_URL=http://localhost:3000
 # INTERNAL_API_BASE_URL=http://sim-app.default.svc.cluster.local:3000  # Optional: internal URL for server-side /api self-calls; defaults to NEXT_PUBLIC_APP_URL
 # TRUSTED_ORIGINS=https://www.example.com,https://app.example.com  # Optional: comma-separated additional public origins to trust for auth (apex+www, alias domains). Merged into Better Auth trustedOrigins.
+# AUTH_TRUSTED_PROXIES=10.0.0.0/24,192.0.2.10  # Optional: reverse-proxy IPs/CIDRs in front of the app. Better Auth walks x-forwarded-for right to left, skips these hops, and uses the first untrusted address as the client IP (prevents forwarded-header spoofing). Use your proxies' actual addresses, not broad private ranges that also cover clients.
 
 # Security (Required)
 ENCRYPTION_KEY=your_encryption_key  # Use `openssl rand -hex 32` to generate, used to encrypt environment variables

apps/sim/lib/auth/auth.ts

@@ -193,6 +193,17 @@ if (validStripeKey) {
   })
 }
 
+/**
+ * Reverse-proxy hops trusted for forwarded-IP resolution. When configured,
+ * Better Auth walks the x-forwarded-for chain right to left, skips these
+ * hops, and records the first untrusted address as the session client IP —
+ * preventing header spoofing behind multi-hop proxies.
+ */
+const trustedProxies = (env.AUTH_TRUSTED_PROXIES ?? '')
+  .split(',')
+  .map((entry) => entry.trim())
+  .filter(Boolean)
+
 export const auth = betterAuth({
   baseURL: getBaseUrl(),
   trustedOrigins: [
@@ -216,6 +227,11 @@ export const auth = betterAuth({
     updateAge: 24 * 60 * 60, // 24 hours (how often to refresh the expiry)
     freshAge: 0,
   },
+  advanced: {
+    ipAddress: {
+      ...(trustedProxies.length > 0 ? { trustedProxies } : {}),
+    },
+  },
   user: {
     deleteUser: {
       enabled: false,

apps/sim/lib/billing/authorization.ts

@@ -16,7 +16,9 @@ const logger = createLogger('BillingAuthorization')
 /**
  * Classify a `/subscription/upgrade` request as a personal checkout using
  * the same reference resolution as the Better Auth Stripe plugin
- * (`@better-auth/stripe` 1.6.13): an explicit `referenceId` defines the
+ * (`@better-auth/stripe` 1.6.23, `referenceMiddleware` — classification
+ * unchanged from 1.6.13; 1.6.23 only moved the resolved `referenceId` into
+ * the middleware return value): an explicit `referenceId` defines the
  * reference (personal iff it is the session user); without one, the
  * reference defaults to the user unless `customerType: 'organization'`
  * selects the session's active organization.

apps/sim/lib/core/config/env.ts

@@ -477,6 +477,9 @@ export const env = createEnv({
     REACT_GRAB_ENABLED:                    z.boolean().optional(),                 // Enable React Grab for UI element debugging in Cursor/AI agents (dev only)
     REACT_SCAN_ENABLED:                    z.boolean().optional(),                 // Enable React Scan for performance debugging (dev only)
 
+    // Network / proxy trust
+    AUTH_TRUSTED_PROXIES:                  z.string().optional(),                  // Comma-separated reverse-proxy IPs or CIDR ranges. When set, Better Auth walks the forwarded-IP chain right to left, skips these trusted hops, and uses the first untrusted address as the client IP. Leave unset to trust only single-value IP headers.
+
     // SSO Configuration (for script-based registration)
     SSO_ENABLED:                           z.boolean().optional(),                 // Enable SSO functionality
     SSO_PROVIDER_TYPE:                     z.enum(['oidc', 'saml']).optional(),    // [REQUIRED] SSO provider type

apps/sim/package.json

@@ -60,8 +60,8 @@
     "@aws-sdk/s3-request-presigner": "3.1032.0",
     "@azure/communication-email": "1.0.0",
     "@azure/storage-blob": "12.27.0",
-    "@better-auth/sso": "1.6.13",
-    "@better-auth/stripe": "1.6.13",
+    "@better-auth/sso": "1.6.23",
+    "@better-auth/stripe": "1.6.23",
     "@browserbasehq/stagehand": "^3.2.1",
     "@calcom/embed-react": "1.5.3",
     "@cerebras/cerebras_cloud_sdk": "^1.23.0",
@@ -129,7 +129,7 @@
     "@trigger.dev/sdk": "4.4.3",
     "@typescript/typescript6": "^6.0.2",
     "ajv": "8.18.0",
-    "better-auth": "1.6.13",
+    "better-auth": "1.6.23",
     "binary-extensions": "3.1.0",
     "browser-image-compression": "^2.0.2",
     "busboy": "1.6.0",