The SessionProvider (src/providers/session.tsx) stores access and refresh tokens in memory and cookies. On hard refresh (Ctrl+Shift+R), memory tokens are lost and the provider attempts to re-bootstrap using only the cookie. With SameSite=Lax; Secure cookies, they may not be sent on certain fetch requests depending on browser security policies, causing the session to appear as "unauthenticated" even when valid cookies exist.
Root cause: Lines 169-177 in src/providers/session.tsx - No cookie re-hydration before request; memory tokens are null after hard refresh.
Why this is architecturally hard
- Hard refresh clears memory state,
SameSite=Lax cookies may not be sent on certain fetch requests
- Backend expects httpOnly cookies but frontend stores tokens in memory for Axios interceptor
clearTokens() called on any 401, but bootstrap failures not distinguished from session revocation
Proposed design
Add a dedicated /auth/session endpoint check before /auth/me that explicitly reads httpOnly cookies. Set localStorage flag on successful login to prevent premature logout broadcasts.
Downstream impact
Backend may need new /auth/session endpoint that reads httpOnly cookies directly.
Acceptance criteria
Getting started
Files: src/providers/session.tsx, src/lib/api.ts
The
SessionProvider(src/providers/session.tsx) stores access and refresh tokens in memory and cookies. On hard refresh (Ctrl+Shift+R), memory tokens are lost and the provider attempts to re-bootstrap using only the cookie. WithSameSite=Lax; Securecookies, they may not be sent on certain fetch requests depending on browser security policies, causing the session to appear as "unauthenticated" even when valid cookies exist.Root cause: Lines 169-177 in src/providers/session.tsx - No cookie re-hydration before request; memory tokens are null after hard refresh.
Why this is architecturally hard
SameSite=Laxcookies may not be sent on certain fetch requestsclearTokens()called on any 401, but bootstrap failures not distinguished from session revocationProposed design
Add a dedicated
/auth/sessionendpoint check before/auth/methat explicitly reads httpOnly cookies. Set localStorage flag on successful login to prevent premature logout broadcasts.Downstream impact
Backend may need new
/auth/sessionendpoint that reads httpOnly cookies directly.Acceptance criteria
Getting started
Files:
src/providers/session.tsx,src/lib/api.ts