Summary
YOUR COOKIE DOMAIN SETTING DOESN'T WORK. Login succeeds, session created, but cookie has no Domain attribute, so browser rejects it. 401 everywhere. Been debugging this for hours. It's not CORS - it's the cookie.
Steps to reproduce
Follow YOUR OWN getting started guide:
bunx @mercurjs/cli@latest create --template basic
Then try to actually deploy it behind a reverse proxy like a normal production setup (Nginx → domain.com → server:9000). You know, the thing EVERYONE does.
Set CORS env vars to the public domain. Set cookieSecure: false. Set cookieOptions: { domain: ".mydomain.com" }.
Spoiler: IT DOESN'T WORK.
Expected result
Cookie should have Domain=.mydomain.com. Browser should send it back. Dashboard should load.
Actual result
Set-Cookie: connect.sid=...; Path=/; Expires=...; HttpOnly
NO DOMAIN. Browser: "I don't know you." 401. 401. 401.
cookieOptions.domain - IGNORED.
cookieDomain in http - IGNORED.
session.cookie.domain - IGNORED.
COOKIE_DOMAIN env - IGNORED.
Tried all of them. None work.
Environment
- Medusa 2.13.4
- Mercur 2.1.2
- Behind Nginx reverse proxy (like EVERY production deployment)
- Public domain with SSL
The real question
How do you actually deploy this behind a reverse proxy?
Your docs say use cookieOptions for this exact scenario, but it doesn't work. Either:
- The config is broken/bugged
- Mercur overrides it somewhere
- We're all missing something that should be in a "Deploying to Production" guide
Plz fix or provide actual working production deployment guide 🙏
The "Getting Started" guide gets you a working localhost setup. Great. Then what? Step 2: "Deploy to actual server" is missing, and the config that SHOULD make it work... doesn't.
Summary
YOUR COOKIE DOMAIN SETTING DOESN'T WORK. Login succeeds, session created, but cookie has no Domain attribute, so browser rejects it. 401 everywhere. Been debugging this for hours. It's not CORS - it's the cookie.
Steps to reproduce
Follow YOUR OWN getting started guide:
Then try to actually deploy it behind a reverse proxy like a normal production setup (Nginx → domain.com → server:9000). You know, the thing EVERYONE does.
Set CORS env vars to the public domain. Set
cookieSecure: false. SetcookieOptions: { domain: ".mydomain.com" }.Spoiler: IT DOESN'T WORK.
Expected result
Cookie should have
Domain=.mydomain.com. Browser should send it back. Dashboard should load.Actual result
NO DOMAIN. Browser: "I don't know you." 401. 401. 401.
cookieOptions.domain- IGNORED.cookieDomaininhttp- IGNORED.session.cookie.domain- IGNORED.COOKIE_DOMAINenv - IGNORED.Tried all of them. None work.
Environment
The real question
How do you actually deploy this behind a reverse proxy?
Your docs say use
cookieOptionsfor this exact scenario, but it doesn't work. Either:Plz fix or provide actual working production deployment guide 🙏
The "Getting Started" guide gets you a working localhost setup. Great. Then what? Step 2: "Deploy to actual server" is missing, and the config that SHOULD make it work... doesn't.