Staging/Production Authentication Fix

Issue: Session works on localhost but breaks on staging with login loops

Last verified against code: 2025-02-03

Quick Fix Checklist

1. ✅ Verify Deployment

Ensure the middleware fix is deployed (see MIDDLEWARE_FIX.md).

2. ⚠️ Check Cookie Domain Settings

Problem: Cookies might not work across subdomains or with HTTPS

Solution - Add to middleware.ts:

// Force cookie settings for production
if (process.env.NODE_ENV === 'production') {
  // Override cookie options with sameSite: 'lax', secure: true
  response.cookies.set({ 
    name, value, 
    ...options,
    sameSite: 'lax',
    secure: true,
  })
}

3. 🔍 Check Supabase Project Settings

Go to Supabase Dashboard → Authentication → URL Configuration:

• Site URL: your staging domain
• Additional Redirect URLs: include all CRM and landlord redirect targets

4. 🌐 Environment Variables

Verify in staging:

• NEXT_PUBLIC_SUPABASE_URL
• NEXT_PUBLIC_SUPABASE_ANON_KEY
• SUPABASE_SERVICE_ROLE_KEY (for intake API)

5. 🍪 Clear Staging Site Cookies

Test in an incognito/private window after redeploy.

Related

• MIDDLEWARE_FIX.md
• Access Control