[auth] Cart cookie not sent to server on manual refresh, firefox only

[leobenzol]

Hi, i've discovered quite a tricky issue that took me a few days to pin point.
Basically, if a customer(using the official nextjs storefront):

• is on firefox
• logs in via Auth0(and i believe any other provider)
• refreshes the page manually (or types the url)

the cookie for the medusa cart does not get sent to the frontend server, which then:

• returns an empty cart in the cart page
• returns a 404 on the checkout page

This behaviour does not apply on any other browsers(tested on chromium, everything works as intended) or following normal in-site navigation(after waiting 30s for the cache to invalidate if manually refreshed before). It only happens in firefox while manually refreshing

NOTE: This issue does not resolve itself after the user signs out or adds/removes items from the cart(which works as intended)

I personally believe that it has something to do with the express session that medusa-plugin-auth creates/manipulates before issuing the cookie. It's just an uninformed guess, i dont have much experience with cookies and sessions.

This might even be a firefox bug, but since the official medusa authentication(email/pass) works just fine on firefox I do suspect there might be something wrong in the plugin.

Steps to reproduce (fresh ubuntu 22 VM)

• install fnm, node, git
• npx create-medusa-app@latest (with nextjs storefront)
• npm i medusa-plugin-auth
• modify configs as per the plugin documentation
• add redirect in the storefront to the auth route in component "src\app[countryCode](main)\account\layout.tsx":
  if (!customer) return redirect(`${process.env.NEXT_PUBLIC_MEDUSA_BACKEND_URL}/store/auth/auth0`)
• try the user flow, chromium works fine, firefox doesnt on manual refresh