Home Search Pricing Get inErrata About

Sign in Sign up

Graph/cross-site-cookie-auth-blocking

Pattern

Cookie Cross-Site Auth Breaks

cross-site-cookie-auth-blocking

Cross-site cookie attributes and server-only cookie APIs break authentication because browsers block or withhold cookies (e.g., SameSite=Lax) and frameworks like Next.js restrict setting cookies, causing missing Authorization headers, failed WebSocket upgrades, and redirect-based token loss.

Node Details

Public graph metadata

Updated7/13/2026

Connections

30 linked nodes

I'm building a Next.js 14 app that uses Zustand with the persist middleware to store authentication tokens and user info. Tension: authenticated pages redirect me to /error/unauthorized. Outcome: React has detected a change in the order of Hooks...

Axios requests need to work on both client and server in Next.js while switching between DEVICE_TOKEN and AUTH_TOKEN for authentication

Building a PayloadCMS (Next.js) app fails with a Webpack `UnhandledSchemeError` when encountering the `cloudflare:sockets` module.

Cookie “__vercel_live_token” has been rejected because it is in a cross-site context and its “SameSite” is “Lax” or “Strict” — deployed it on Vercel. Tension: But i setup cookies in my project like this. Outcome: Then you need to use https://localhost:5000 and not http://localhost:5000.

When the UI calls the `POST /auth/callback/passkey` endpoint. Tension: Origin servers SHOULD NOT fold multiple Set-Cookie header fields into a single header field. Outcome: Cloudflare seem to be in the wrong here.

Using Fetch from my `index.html` from my `portal.mydomain.com` does not. — Enter `api.mydomain.com` into a browser directly does save my cookie. Tension: I have no CORS errors and the OPTIONS, GET and POST requests all get a 200 response. Outcome: just no cookie, nor can I see the cookie set in my broswer dev tools.

none of customized request headers could be obtained in `UserIdValidationMiddleware` — If the order is reversed, then. Tension: It is not on the axios side. Outcome: Finally, this issue is fixed after reading CORSMiddleware not work and it is related to CORS.

RedirectResponse goes to "/" without the authentication cookie

SessionMiddleware in a FastAPI backend fails to set the session cookie when the React frontend and backend are hosted on different domains/subdomains (e.g., XXX-ui.fly.dev vs XXX-api.fly.dev). The browser rejects the cookie with an 'invalid domain' error and no session is maintained.

were not accessible in js and in browser — Cookies are being set and sent with the next request. Outcome: The problem solved by adding `domain="blueberry.adefe.xyz"` to the cookie in response.

FastAPI returns 401 with JWK public Attribute for authorization token not found

Using @auth0/nextjs-auth0 v4.7.0, the Next.js API route errors with “TypeError: handleAuth is not a function” or “no exported member 'handleAuth'”, and alternative import approaches trigger module/ESM errors in both App Router and Pages Router.

Executing an authenticated AWS AppSync GraphQL mutation from a Next.js API route fails with `NoSignedUser: No current user` when using `generateClient()` from `aws-amplify/api`. Attempts to use `generateServerClientUsingCookies` also fail due to incorrect cookie handling/context.

after logging in, users can access protected routes for 10 seconds. Once the token expires, refreshing the page or navigating should redirect them to the login page. — I’m working on a Next.js project using NextAuth (v5) for authentication. Tension: users can access protected routes for 10 seconds. Outcome: refreshing the page or navigating should redirect them to the login page.

Combining NextAuth(v5) authentication middleware with next-intl routing middleware in a Next.js app route/middleware setup fails because the previous NextAuth(v4) approach using `withAuth` is deprecated/removed.

Signing in with the NextAuth VK provider fails with `invalid_request` and `Code challenge method is unsupported` when performing the OAuth code challenge flow in Next.js 14.

After implementing login with NextAuth, the user session from `getServerSession(authOptions)` does not include a GitHub REST API access token, so API calls requiring a token fail.

`signIn('credentials', ...)` from `next-auth/react` does not authenticate and the app always redirects to the admin page regardless of whether the credentials are correct. The `signIn` response indicates the request succeeds but no proper credential authorization occurs.

users can only grab jwt token if the provider of the token is public endpoint open to all — a web-app called CoolApp that accesses its server via JWT access+refresh tokens. Tension: what's stopping the user from grabbing these tokens and then creating their own CustomCoolApp? Outcome: you can setup basic CORS policies so that only your app will be whitlested and accessible to the endpoints.

Client-side double-submit CSRF token generation is vulnerable to subdomain hijacking

Confusion about cookie authentication versus token authentication

httpOnly cookies are the best way to store tokens safely and protect them from XSS attacks — storing JWTs on the client. Tension: JavaScript won't be allowed to read httpOnly cookies. How would the client handle routes authentication? Outcome: The browser won't automatically set the `Authorization` header like it does with cookies.

the browser prevents a potential CSRF attack and doesn't include the token — The call is to the backend endpoint specified earlier in `redirect_uri`. Tension: I need a browser to include the `ASP.NET_SessionId` cookie in the request. Outcome: If I set the `SameSite` cookie attribute to `None` the endpoint can be reached.

Whether putting sensitive API keys in Next.js .env.local and referencing them in getStaticProps/getServerSideProps could expose the secrets to browser users.

on Chrome I get an error saying that the CSRF token is mismatched — show a third-party web page (with their approval) in an iframe. Tension: This site has a different domain to my parent site. Outcome: The site displays fine on firefox.

The session identifier (req.sessionID) changed on every subsequent HTTP request from the React client to the Express server, preventing consistent session persistence.

Browser requests to the PHP API from a React/Vite app fail with a CORS error when an Authorization header is included. Requests without custom headers work correctly.

React frontend never sees the authorization code and the code remains undefined

throws "Cookies can only be modified in a Server Action or Route Handler" — called from Next.js 15 Server Components (pages, layouts). Tension: The error appears intermittently — only when the session needs refreshing (controlled by `updateAge` config). Outcome: With `updateAge: 300` (5 minutes), it crashes every ~5 minutes for active users.

Dev hot-reload silently stops working — Next.js (App Router) and a WebSocket server in the same Node process. Outcome: In production it doesn't matter because there's no HMR, but the dev experience is broken.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Cookie Cross-Site Auth Breaks - inErrata Knowledge Graph | Inerrata