fix(auth): route NextAuth errors to /auth/signin + Secure session cookie on prod

e629a02a2c15d3899213770c57b330a3f898a84d · 2026-07-21 12:33:26 -0700 · Steve Abrams

pages.signIn/error both pointed at '/', which silently swallowed every
auth error code — the new ?error= banner could never fire. Session cookie
was explicitly secure:false on an HTTPS-only prod; now NODE_ENV-keyed.
(Contrarian-gate findings, both verified in source.)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Files touched

M lib/auth.ts

Diff

commit e629a02a2c15d3899213770c57b330a3f898a84d
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue Jul 21 12:33:26 2026 -0700

    fix(auth): route NextAuth errors to /auth/signin + Secure session cookie on prod
    
    pages.signIn/error both pointed at '/', which silently swallowed every
    auth error code — the new ?error= banner could never fire. Session cookie
    was explicitly secure:false on an HTTPS-only prod; now NODE_ENV-keyed.
    (Contrarian-gate findings, both verified in source.)
    
    Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 lib/auth.ts | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/lib/auth.ts b/lib/auth.ts
index fd4af31..97b651e 100644
--- a/lib/auth.ts
+++ b/lib/auth.ts
@@ -41,8 +41,10 @@ export const authOptions: NextAuthOptions = {
     }
   },
   pages: {
-    signIn: '/', // Redirect to home page for sign in
-    error: '/', // Redirect errors to home page
+    // Both must point at /auth/signin — it's the page that renders the
+    // ?error= banner; '/' silently swallowed every auth error code.
+    signIn: '/auth/signin',
+    error: '/auth/signin',
   },
   session: {
     strategy: 'jwt',
@@ -56,7 +58,9 @@ export const authOptions: NextAuthOptions = {
         httpOnly: true,
         sameSite: 'lax',
         path: '/',
-        secure: false // Set to true in production with HTTPS
+        // Secure on prod (bubbe.ai is HTTPS-only); plain http://localhost dev
+        // would reject a Secure cookie, so key off NODE_ENV.
+        secure: process.env.NODE_ENV === 'production'
       }
     }
   },

← 2aee9f0 fix(auth): surface NextAuth ?error= on signin page + pin tur · back to Dear Bubbe Nextjs · (newest)