Gerhard Scheikl
143fec7971
@supabase/ssr derives the auth cookie storage key from the hostname of the URL it is given (sb-<sub>-auth-token). After routing server-side clients at the internal host (kong-prod), the server looked for sb-kong-prod-auth-token while the browser had set sb-api-auth-token, so server-side getUser() never found the just-established session and bounced the user off the MFA challenge back to /login. Pin every client (browser, server, middleware) to the name derived from NEXT_PUBLIC_SUPABASE_URL via a shared helper so the namespace stays consistent regardless of which API endpoint the client talks to.