- Move cookie setting from cookies().set() to response.cookies.set() in
login/logout routes (Next.js 15 ambient cookie merge is unreliable)
- Generate random JWT_SECRET at module scope in auth.ts for dev mode so
every server start invalidates all prior sessions
- Replace blank page on auth failure with redirect to /login in dashboard layout
- Preserve ?redirect= param from middleware in login form
- Wrap login page in Suspense boundary for useSearchParams()
Fixes: double-login bug, session persistence across restarts, blank page on
session expiry
TroodonEnjoyer
Chariah