fix: detect deployed Auth.js session cookie

src/lib/proxy-access.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { shouldRedirectAdminRequest, usesSecureAuthCookie } from "./proxy-access";
+import { authSessionCookieName, shouldRedirectAdminRequest } from "./proxy-access";
 
 describe("shouldRedirectAdminRequest", () => {
   it("redirects anonymous admin requests before rendering", () => {
@@ -13,9 +13,17 @@ describe("shouldRedirectAdminRequest", () => {
   });
 });
 
-describe("usesSecureAuthCookie", () => {
-  it("matches Auth.js production cookie naming", () => {
-    expect(usesSecureAuthCookie("production")).toBe(true);
-    expect(usesSecureAuthCookie("development")).toBe(false);
+describe("authSessionCookieName", () => {
+  it("detects secure and unprefixed Auth.js cookies from the request", () => {
+    expect(authSessionCookieName(["__Secure-authjs.session-token"])).toBe("__Secure-authjs.session-token");
+    expect(authSessionCookieName(["authjs.session-token"])).toBe("authjs.session-token");
+  });
+
+  it("detects a chunked production session cookie", () => {
+    expect(authSessionCookieName(["__Secure-authjs.session-token.0", "__Secure-authjs.session-token.1"])).toBe("__Secure-authjs.session-token");
+  });
+
+  it("returns null when no session cookie exists", () => {
+    expect(authSessionCookieName(["theme"])).toBeNull();
   });
 });

src/lib/proxy-access.ts

@@ -2,8 +2,13 @@ export interface ProxyToken {
   rank?: unknown;
 }
 
-export function usesSecureAuthCookie(environment: string | undefined): boolean {
-  return environment === "production";
+const AUTH_COOKIE_NAMES = ["__Secure-authjs.session-token", "authjs.session-token"] as const;
+
+export function authSessionCookieName(cookieNames: readonly string[]): string | null {
+  for (const base of AUTH_COOKIE_NAMES) {
+    if (cookieNames.some((name) => name === base || name.startsWith(`${base}.`))) return base;
+  }
+  return null;
 }
 
 export function shouldRedirectAdminRequest(pathname: string, token: ProxyToken | null): boolean {

src/proxy.ts

@@ -1,6 +1,6 @@
 import { type NextRequest, NextResponse } from "next/server";
 import { getToken } from "next-auth/jwt";
-import { shouldRedirectAdminRequest, usesSecureAuthCookie } from "@/lib/proxy-access";
+import { authSessionCookieName, shouldRedirectAdminRequest } from "@/lib/proxy-access";
 
 // Edge proxy (formerly "middleware"): Prisma can't run here, so we only forward
 // the request path (so server components / the access guard can read it via
@@ -9,8 +9,9 @@ import { shouldRedirectAdminRequest, usesSecureAuthCookie } from "@/lib/proxy-ac
 export async function proxy(req: NextRequest) {
   if (req.nextUrl.pathname === "/admin" || req.nextUrl.pathname.startsWith("/admin/")) {
     const secret = process.env.AUTH_SECRET;
-    const token = secret
-      ? await getToken({ req, secret, secureCookie: usesSecureAuthCookie(process.env.NODE_ENV) })
+    const cookieName = authSessionCookieName(req.cookies.getAll().map((cookie) => cookie.name));
+    const token = secret && cookieName
+      ? await getToken({ req, secret, cookieName })
       : null;
     if (shouldRedirectAdminRequest(req.nextUrl.pathname, token)) {
       return NextResponse.redirect(new URL("/login", req.url));