Merged PR 2315: Auth stabilistatiion and hardening

Related work items: #23020

context/auth-session-reliability.md

@@ -0,0 +1,34 @@
+# Auth & Session Reliability Notes
+
+Last updated: 2026-05-13
+
+## Known issue
+
+Users are intermittently prompted to sign in again despite apparently valid prior session state.
+
+## Confirmed risk contributors in code
+
+1. Duplicated logout/cookie clearing logic across multiple components.
+2. Mixed callback cookie names in runtime history (`next-auth.callback-url` and `__Secure-next-auth.callback-url`).
+3. Redirect URL parsing that could fail hard on malformed/unexpected URL inputs.
+4. Hard SSR redirects to `/auth/signin` on missing/transient upstream account/contact states.
+
+## Stabilisation changes started
+
+- Added `lib/auth/sessionClient.js`:
+    - normalized cookie/session artifact cleanup
+    - shared signed-out callback path by locale
+    - shared `performPortalSignOut(...)` helper
+- Adopted helper in:
+    - `components/timeout/index.js`
+    - `components/myportal/servicebanner.js`
+    - `components/header.js`
+- Updated NextAuth callback locale detection to check both callback cookie variants.
+- Hardened NextAuth URL append and redirect parsing fallbacks.
+
+## Remaining auth hardening backlog
+
+1. Migrate remaining logout implementations to shared helper.
+2. Add request-correlation-safe auth diagnostics (no secrets/tokens).
+3. Evaluate session TTL/update strategy (`maxAge`, `updateAge`) with production evidence.
+4. Add env validation checks for `NEXTAUTH_URL`, `CY_API_ROOT`, proxy/header assumptions.