- Shipped
- June 15, 2026 at 7:27 PM UTC
- Author
- kamo
- Commit
- f66716b
Right after the sessionStorage switch ships, every browser still has its old *** cookie. The migration adopted that value into sessionStorage (and the server cookie-fallback could read it too) — a stale/expired cookie then resolves server-side as a real-but-invalid session, so /api/user-info returns invalid_session (401) and useUserInfo bounces to /logout right after a successful login. Clear the legacy cookie on boot without adopting it: a missing token now degrades to the harmless no_session (no redirect), and the freshly-validated token in sessionStorage is the only carrier. Also guard SessionManager from redirecting to /logout while on /validate or /logout.