# Auth & Session Reliability Notes

Last updated: 2026-05-13

## Known issue

Users are intermittently prompted to sign in again despite apparently valid prior session state.

## Confirmed risk contributors in code

1. Duplicated logout/cookie clearing logic across multiple components.
2. Mixed callback cookie names in runtime history (`next-auth.callback-url` and `__Secure-next-auth.callback-url`).
3. Redirect URL parsing that could fail hard on malformed/unexpected URL inputs.
4. Hard SSR redirects to `/auth/signin` on missing/transient upstream account/contact states.

## Stabilisation changes started

- Added `lib/auth/sessionClient.js`:
    - normalized cookie/session artifact cleanup
    - shared signed-out callback path by locale
    - shared `performPortalSignOut(...)` helper
- Adopted helper in:
    - `components/timeout/index.js`
    - `components/myportal/servicebanner.js`
    - `components/header.js`
- Updated NextAuth callback locale detection to check both callback cookie variants.
- Hardened NextAuth URL append and redirect parsing fallbacks.

## Remaining auth hardening backlog

1. Migrate remaining logout implementations to shared helper.
2. Add request-correlation-safe auth diagnostics (no secrets/tokens).
3. Evaluate session TTL/update strategy (`maxAge`, `updateAge`) with production evidence.
4. Add env validation checks for `NEXTAUTH_URL`, `CY_API_ROOT`, proxy/header assumptions.