Logged in on myapp.com but logged out on app.myapp.com

Open · 487 views · asked 2 months ago by lotte_j · edited

Marketing site at myapp.com (Next.js), the actual app at app.myapp.com (also Next.js, separate Vercel project). Same Supabase project. When someone logs in on the marketing site and clicks 'Go to app', they're logged out there. I want one login for both.

What I’ve tried

Tried setting the cookie domain in the Supabase dashboard but there's no such setting. Cursor wrote code to pass the access token in the URL, which feels wrong.

Comment

2 answers

jonas_k2 months ago · edited

Your instinct about the URL token is right, don't do that (tokens end up in logs and browser history).

Cookies are per host by default. With @supabase/ssr you can set the cookie domain on the parent domain in both apps (browser client, server client and middleware):

createBrowserClient(url, key, {
  cookieOptions: { domain: '.myapp.com' },
})

Then the auth cookie is sent to both myapp.com and app.myapp.com. Locally this doesn't work on plain localhost, so make the option conditional on production.

Comment

Works on production! Old users had to log in once more because they still had the host-only cookie. lotte_j 2 months ago · edited

Only do this if you control every subdomain. Any subdomain (e.g. a hosted blog on blog.myapp.com) can then read the session cookie. amir_h 2 months ago · edited

dev_ana2 months ago · edited

Another option: serve the app under myapp.com/app using rewrites from the marketing project to the app project. One host, one cookie, no domain option. Depends on whether you want the separate subdomain for other reasons.

Comment

Keyboard shortcuts

Logged in on myapp.com but logged out on app.myapp.com

What I’ve tried

2 answers

Your answer

Logged in on myapp.com but logged out on app.myapp.com

What I’ve tried

2 answers

Related

Your answer