fix(auth): scope OAuth session cookie via secure + AUTH_COOKIE_PREFIX

[tvi]

Set the Auth.js OAuth session cookie explicitly with the __Secure- prefix and an optional AUTH_COOKIE_PREFIX. Cookies are scoped by host+path+name (not port), so multiple local dashboards on different localhost ports would otherwise share the default session cookie and clobber each other.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
web	Ready	Preview, Comment	Jun 9, 2026 9:38pm
web-juliett	Ready	Preview, Comment	Jun 9, 2026 9:38pm

[cursor]

PR Summary

Low Risk
Session cookie naming and flags only; production behavior follows standard secure cookies unless AUTH_COOKIE_PREFIX is set locally.

Overview
Multiple local dashboards on different localhost ports shared the default Auth.js OAuth session cookie and overwrote each other’s sessions because cookies are not scoped by port.

The OAuth NextAuth config now sets useSecureCookies from production on Vercel, uses the __Secure- cookie name prefix in production, and optionally prefixes the session cookie name with AUTH_COOKIE_PREFIX so each local instance can use a separate cookie.

^{Reviewed by Cursor Bugbot for commit fa6ae50. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale comment