next auth v5, Google provider. Works on and works on the production domain. On preview deployments it fails two different ways and I cannot work out why it is not consistent. Sometimes Google itself shows "Error 400:…
We use JWT sessions with a 30 minute expiry, no database read on normal requests. Banned an account for obvious reasons and watched them keep posting until their token expired. I know why this happened. What I do not…
First multi tenant thing I have built. Every row has an and every query filters on it. The convenient thing is to put in the token so the server does not look up membership on every request. Half of what I read says…
Marketing site and login live on , the actual product is on . Both https, same certificate, same everything. After login the cookie is visibly set I can see it in the response, I can see it in devtools on . Navigate to…
2,100 registered users, maybe 600 monthly active. Currently on the free tier of a hosted auth provider and about to cross into paid, which lands somewhere around $25/month plus per user beyond the included bucket. I am…
Server sessions, sessions table in Postgres on Neon, serverless functions. Every authenticated request does one lookup by session token. With the lookup: p50 around 68ms. With it stubbed out: p50 around 27ms. So the…