pedwfrontend/context/auth-session-reliability.md

Auth & Session Reliability Notes

Last updated: 2026-05-13

Known issue

Users are intermittently prompted to sign in again despite apparently valid prior session state.

Confirmed risk contributors in code

1. Duplicated logout/cookie clearing logic across multiple components.
2. Mixed callback cookie names in runtime history (next-auth.callback-url and __Secure-next-auth.callback-url).
3. Redirect URL parsing that could fail hard on malformed/unexpected URL inputs.
4. Hard SSR redirects to /auth/signin on missing/transient upstream account/contact states.

Stabilisation changes started

• Added lib/auth/sessionClient.js:
  • normalized cookie/session artifact cleanup
  • shared signed-out callback path by locale
  • shared performPortalSignOut(...) helper
• Adopted helper in:
  • components/timeout/index.js
  • components/myportal/servicebanner.js
  • components/header.js
• Updated NextAuth callback locale detection to check both callback cookie variants.
• Hardened NextAuth URL append and redirect parsing fallbacks.

Remaining auth hardening backlog

1. Migrate remaining logout implementations to shared helper.
2. Add request-correlation-safe auth diagnostics (no secrets/tokens).
3. Evaluate session TTL/update strategy (maxAge, updateAge) with production evidence.
4. Add env validation checks for NEXTAUTH_URL, CY_API_ROOT, proxy/header assumptions.