Spike: validate cross-subdomain cookies, prefixes, and local hostnames on the real domain before building on them

[pataniaeli]

Ticket: AUTH-T104 · Epic: E4 Sessions & SSO · Phase: Phase 1 — Core auth, sessions, SSO (MVP)
Priority: Urgent · Estimate: 2 points · Labels: epic:sessions, phase:1, spike, sso, better-auth

Depends on:

• Create the Vercel project, custom domains, environments, and Neon preview branching #16 — AUTH-T05 Create the Vercel project, custom domains, environments, and Neon preview branching
• Parent-domain session cookie for *.northeasternsga.com #38 — AUTH-T26 Parent-domain session cookie for *.northeasternsga.com

Community reports (better-auth issues #5611, #3938) describe cross-subdomain cookies being set and then dropped in some configurations. Before any product integration work, deploy the minimal Better Auth config to auth-dev.northeasternsga.com and a static stub on stub-dev.northeasternsga.com, then verify in Chrome, Firefox, and Safari: (1) login sets exactly one __Secure-sgauth-dev.session_token cookie with Domain=northeasternsga.com; (2) the stub's server receives it and the session endpoint resolves it; (3) sign-out clears it on both hosts; (4) the SGAUTH_ENV=preview host-only mode works on a *.vercel.app preview; (5) the local *.sga.localhost scheme works in all three browsers or the fallback (hosts-file sga.test) is adopted; (6) a stale cookie with the same name set by the stub host (cookie tossing) is observed and its effect documented. Record findings in docs/ENVIRONMENTS.md and adjust AUTH-T26/T34 accordingly.

Acceptance criteria

• Findings documented per browser with screenshots or HAR excerpts; any Better Auth version pin or workaround recorded.
• Go/no-go on the parent-domain cookie approach signed off by the SGAuth lead.

_{Generated from the SGAuth design (docs/sgauth-design in SGAOperations/auth). SGAuth is built on Neon and does not use Supabase.}