35 lines
1.4 KiB
Markdown
35 lines
1.4 KiB
Markdown
# Auth & Session Reliability Notes
|
|
|
|
Last updated: 2026-05-13
|
|
|
|
## Known issue
|
|
|
|
Users are intermittently prompted to sign in again despite apparently valid prior session state.
|
|
|
|
## Confirmed risk contributors in code
|
|
|
|
1. Duplicated logout/cookie clearing logic across multiple components.
|
|
2. Mixed callback cookie names in runtime history (`next-auth.callback-url` and `__Secure-next-auth.callback-url`).
|
|
3. Redirect URL parsing that could fail hard on malformed/unexpected URL inputs.
|
|
4. Hard SSR redirects to `/auth/signin` on missing/transient upstream account/contact states.
|
|
|
|
## Stabilisation changes started
|
|
|
|
- Added `lib/auth/sessionClient.js`:
|
|
- normalized cookie/session artifact cleanup
|
|
- shared signed-out callback path by locale
|
|
- shared `performPortalSignOut(...)` helper
|
|
- Adopted helper in:
|
|
- `components/timeout/index.js`
|
|
- `components/myportal/servicebanner.js`
|
|
- `components/header.js`
|
|
- Updated NextAuth callback locale detection to check both callback cookie variants.
|
|
- Hardened NextAuth URL append and redirect parsing fallbacks.
|
|
|
|
## Remaining auth hardening backlog
|
|
|
|
1. Migrate remaining logout implementations to shared helper.
|
|
2. Add request-correlation-safe auth diagnostics (no secrets/tokens).
|
|
3. Evaluate session TTL/update strategy (`maxAge`, `updateAge`) with production evidence.
|
|
4. Add env validation checks for `NEXTAUTH_URL`, `CY_API_ROOT`, proxy/header assumptions.
|