A route mounted on the target host and excluded from middleware entirely — not merely marked public. It deletes every auth cookie on that host, then forwards into the app carrying the session token, so the handshake starts from a clean jar. Redirects are restricted to same-origin absolute paths, so it can never become an open redirect.
Also called: signed out after switching · session lost switching accounts · nav collapsed after switch
- 1The switcher builds the link using the auth provider's own cross-origin URL builder rather than parsing cookies by hand.
- 2The landing route reads the destination path and the carried view, and rebuilds the origin from the Host header.
- 3Every auth cookie on the host is deleted in two forms: host-only and with an explicit Domain attribute.
- 4The browser applies the deletions before following the redirect into the app.
- 5Cookies scoped to a shared parent domain are untouched, so the production session is never at risk.
- 6If no token was attached, the code logs an explanatory error rather than shipping the user to a signed-out shell.
Filed as L2B-YUD42Z, and the route's header is a full post-mortem. A previously-visited-signed-out host 'leaves Clerk's SUFFIXED cookies behind… The handshake only rewrites the UNsuffixed names, clerk-js on arrival prefers the suffixed ones, decides you are signed out, and wipes the session it was just handed.' The symptom is described as users saw it: 'nav collapsed to Home + Project Mgmt, profile block stuck on skeletons, no way to tell which account you were in.' And the crucial deployment detail: the route is excluded from the middleware matcher because the handshake 'fires on the very first request to a host even for public routes, and it consumes (strips) the ?__clerk_db_jwt it sees.' The two cookie-deletion forms exist because 'a deletion only matches a cookie whose Domain attribute matches exactly.'
- Stale auth cookies on a previously visited host silently overrode a valid new session.
- The failure was deterministic per host, so it looked random to the user.
- A generic 'public route' marking wasn't enough — the handshake consumed the token first.
See it on your own jobs
Twenty minutes, your numbers, no slide deck. We’ll build one of your real buildings in front of you and send you the estimate link at the end — yours to keep either way.
or keep browsing features →