Some magic-link sign-ins were failing on the first click and only working on a manual page reload. The token was valid, but the session cookie wasn't being set in time.

Root cause

A race between the cookie write and the redirect — the redirect was firing before the Set-Cookie header committed in some edge runtimes.

Fix

Switched the redirect to a 303 with explicit Cache-Control: no-store, and moved the cookie write into a synchronous step before the redirect Response is returned.

Lessons

This is the kind of bug that only shows up when the system is under real (not test) load. Worth investing in load tests for the auth path.

← Older

Built a 200-line A/B testing framework (no third-party SDK)

Newer →

Wired Web Vitals, Sentry, and Slack alerts end-to-end

See the full changelog

Or peek at what we’re building next on the roadmap.

Back to changelog See roadmap