Hi Team, We're seeing the Descope SDK create 2 DS cookies in one environment but only 1 cookie in another. Environment 1 (abc.dev.maindomain.com): Creates 2 DS cookies • ds: abc.dev.maindomain.com (created on login) • ds: .abc.dev.maindomain.com (created after manual page refresh) Environment 2 (xyz.supportdev.maindomain.com): Creates 1 DS cookie • ds: xyz.supportdev.maindomain.com only (1 only even after refresh) Details: • Same SDK version on both • Both environments have almost identical Descope project settings • No custom domains configured • The second cookie with leading dot only appears when user manually refreshes the page after logging in Question: Why does abc.dev.maindomain.com get 2 DS cookies but xyz.supportdev.maindomain.com only gets 1? Thanks!

Hey @Harsh Gor can you provide some specifications like which SDK and the version your using so we can verify this behavior?

@Atharva Joshi "@descope/nextjs-sdk": "^0.12.16",

Thanks @Harsh Gor let me check

Okay thanks will get back to you if its still a issue.

Could you confirm these for me? 1. the project's session management settings 2. the code snippet for the authProvider - is he using sessionTokenViaCookie? or refreshTokenViaCookie? also if your cookie setup is done with custom domain

1,2 - Images 3 - No custom domain configured @Atharva Joshi

so sessionTokenViaCookie is set to false?

@Atharva Joshi sessionTokenViaCookie = { sameSite: 'Lax' },

okay so your both tokens are set to manage in response body and your setting sessionTokenViaCookie to sameSite: 'Lax' this is a misconfiguration. Please set manage in cookies and set a custom domain in your project. please clear your cookies and cache and try again to check if this occurs again

@Atharva Joshi i think thats not an issue, because as we have other environments which have the same configuration, in those envs it is working as expected, also there is no custom domain in other envs.

I see Im guessing this may have happened when some settings regarding the JWT or cookies was changed and the older cookie remained in the storage. This is why we need to clear the cookies and cache and see if this behaviour occurs again

i did that already many times, cleared whole site data and also tried different browser also

Let me try to reproduce with these configurations

Hi @Atharva Joshi any updates?

still trying to reproduce

see in our app [image] and yes its affects the user in impersonation, after impersonation one of 2 cookie is replaced to target user and then when page get refreshed the system picks other cookie instead of the new replaced cookie with target user details. and if i try on local server or any other env with same configuration of project it works there perfectly fine, only 1 ds cookie and it replaces after impersonation so system pick correct 1 coz only 1 available, the problem is only with dev server @Atharva Joshi

I tried implementing this Even after impersonation the DS cookie just replaces the existing cookie (verified by the change in size of the cookie) @Harsh Gor please share a HAR file of the event so we can investigate further https://docs.descope.com/support/generate-debug-info

ok thanks will get back with those info

Yea, @Harsh Gor - I agree that we should probably gather a fresh HAR and Console log for this one and raise an issue via the support plugin or

<mailto:support@descope.com|support@descope.com>

to dig in further. 1. Inspect and clear local storage, cookies, etc and set preserve logging/etc a. Outlined here https://docs.descope.com/support/generate-debug-info#har-and-console-logs 2. It probably makes sense to record a video of the behavior as well as you reproduce, so zoom, loom, quicktime, etc for screen recording 3. Login, show the current token in local storage 4. Do the manual page refresh and show the changes 5. Export the HAR/console log and share via support avenues https://docs.descope.com/support