2FA that bounced people back to login
A host-only CSRF cookie wasn't sent across subdomains, so completing the OTP step redirected back to login. Fixed with an explicit cookie domain.
It could not have worked
A race, an ordering, one column holding two things. The shape ruled it out before the code ran.
Right after moving super-admin auth to env vars with Redis-backed email 2FA, completing the OTP step landed you back at login. The CSRF cookie was host-only and the second leg of the exchange is served from a different subdomain, so the token simply wasn't visible to the request that needed it.
Fixed by setting the cookie domain explicitly across subdomains, deliberately not applied to the refresh cookie, which stays host-only. Broadening a cookie's scope to unbreak a flow is very easy to over-apply to every cookie in the file.