zooqueen 29a4c7f34a auth: let NextAuth name the session cookie ...

The name carries a __Secure- prefix over https, and NextAuth derives that from
NEXTAUTH_URL in both directions — when it writes the cookie, and in getToken
when the middleware reads it. Naming it here broke that agreement: the name was
keyed to VERCEL_URL, unset off Vercel, so the app wrote `next-auth.session-token`
while the middleware looked for `__Secure-next-auth.session-token`.

Signing in worked perfectly the whole time — a real session, a real cookie,
/api/auth/session returning the user — and every guarded route still bounced to
/login, which looks exactly like a rejected password.

The override existed to pin a Vercel apex domain; nothing here is on Vercel.

2026-08-14 19:46:25 -07:00

..

[...nextauth].ts

auth: let NextAuth name the session cookie

2026-08-14 19:46:25 -07:00