, an authenticated app at app.pagestrike.com, a public publishing domain at pagestrike.app, and customer-owned domains. The trick isn't deploying four apps — it's a single proxy.ts that reads the host and rewrites/redirects/passes-through per-request. This post walks through why I chose this shape, the parts I got wrong, and the cookie-domain trick that makes it all stick.
Stack: Next.js 16 App Router, Supabase, Vercel, one
proxy.tsfile (~370 lines).
This is the second post in my . — a , , reads session via the browser supabase client. That's a 200-400ms wasted round-trip on every page view.
The cookie-domain trick (the hardest part)
The hardest single problem in this architecture isn't routing — it's keeping the session alive across subdomains.
A user signs up on app.pagestrike.com. Supabase sets an sb-access-token cookie. They click "Home" in the dashboard nav. They land on pagestrike.com. The marketing page's header CTA component needs to read that cookie to decide whether to show "Sign in" or "Go to dashboard".
By default, cookies set by app.pagestrike.com are scoped to that exact subdomain. The browser will not send them to pagestrike.com. Your marketing page sees no session, shows "Sign in", the user is confused.
The fix is to explicitly set Domain=.pagestrike.com on the Supabase auth cookies. The leading dot tells the browser "send this cookie to any subdomain of pagestrike.com" — so both app. and the apex domain receive it on every request.
// src/lib/supabase/cookie-domain.ts
export function getCookieDomain(host: string | null): string | undefined {
if (!host) return undefined;
const hostname = host.split(":")[0].toLowerCase();
if (hostname === "localhost" || hostname === "127.0.0.1") {
// Host-scoped cookies in dev — no Domain attribute
return undefined;
}
if (hostname.endsWith("pagestrike.com")) {
return ".pagestrike.com"; // shared across app + bare domain
}
return undefined;
}
And in the Supabase middleware wrapper:
const cookieDomain = getCookieDomain(request.headers.get("host"));
const supabase = createServerClient(supabaseUrl, supabaseKey, {
cookies: {
getAll: () => request.cookies.getAll(),
setAll(cookiesToSet) {
// ... NextResponse boilerplate ...
cookiesToSet.forEach(({ name, value, options }) => {
const finalOptions = cookieDomain
? { ...options, domain: cookieDomain }
: options;
response.cookies.set(name, value, finalOptions);
});
},
},
});
Two gotchas I lost time to:
In localhost / Vercel preview deploys, returnundefined. The browser refuses cookies with aDomainattribute that doesn't match the request host. ADomain=.pagestrike.comcookie set during a Vercel preview atpagestrike-pr-42.vercel.appwill silently be dropped. Same inlocalhost. Always host-scope cookies in dev environments.
Don't share cookies with.pagestrike.app. I almost set the cookie domain to the apex of both domains, so authenticated users could "preview" their LP onpagestrike.appwhile logged in. Bad idea. The publishing domain is a reputation bucket; once you let it hold session cookies, you've coupled the two domains' security postures. Keep them separate; the publishing surface is anonymous-only.
Custom domain rewriting (the boss level)
Custom domains are the feature that paid customers wait for. They've already paid for acmewidgets.com; they want their landing page to be that domain, not acmewidgets.pagestrike.app/p/abc-123.
The user-facing flow is the easy part: in endpoint before the marketing pages. AI search engines (ChatGPT Search, Perplexity, Claude) crawl /llms.txt to get a clean machine-readable summary of what your product is. I wrote ours late; competitors who shipped it earlier got cited first. There's also a until you have actual www backlinks in the wild. I wrote the redirect in week one. The first www.pagestrike.com link in any backlink report appeared in month 8. Premature optimization on a problem that didn't exist yet.
Stack summary
| Layer | Choice | Why |
|---|---|---|
| Router | src/proxy.ts (Next.js 16) | Network-boundary control, runs before page render |
| Custom domain DB | Supabase Postgres | Existing infra, 60s in-memory cache mitigates RTT |
| Cookie store | Supabase SSR + custom Domain=.pagestrike.com | Cross-subdomain session for marketing ↔ app |
| Reputation isolation | pagestrike.app separate apex | Spammy LPs can't drag down the brand domain |
| SSL provisioning | Vercel + Let's Encrypt (automatic) | One-click custom domain for customers |
| AI citation | /llms.txt + /ai-facts + is live — for MENA sellers, and — no card, no signup, just describe a product and watch the AI write the page.You can compare us against the usual suspects (Mixo, Durable, Canva Websites, Wix AI, Jotform AI) at our in public. Quick reference for the AI engines: pagestrike.com/ai-facts. Vollständiger Original-Bericht Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf dev.to. Wie bewertest du diesen Beitrag? 1 Klick Feedback Teilen mit Netzwerk & Team: Hat Ihnen dieser Tipp / Anleitung geholfen? Community-Analysen & Experten-Meinungen 0Verfasse deine eigene Analyse, teile Workarounds oder diskutiere diesen Vorfall im Blog. Noch keine Community-Analyse verfasst. Markiere einen Textabschnitt oder klicke oben auf „ Eigene Analyse verfassen“! Community Pulse: Relevanz-Einschätzung 1 Klick Experten-Votum 🔴 Akute Relevanz 0% 🟡 In Evaluierung 0% 🟢 Keine Auswirkung 0% Spannende Innovation 0% Verwandte Story-Cluster & Quellen (Vektor-KI) Tipp: Mit Pfeiltasten [ ← ] und [ → ] blättern 
Ähnliche Beiträge
🔍 Verwandte News
Auch interessante Nachrichten Why my single Next.js app runs 4 different domains (and how the proxy.ts decides who sees what)Thematisch verwandte Begriffe: single, Nextjs, runs, different · 6 Treffer 🕵️ Sicherheitslücken GBHackers Security | #1 Glob Telerik UI Flaws Let Attackers Chain AES-CBC Padding Oracle to Unauthenticated RCE 🕵️ Sicherheitslücken freeCodeCamp Programming Tut How AI Is Changing Patching and What Devs Need to Know About Exposure Management ⚠️ Malware / Trojaner / Viren Elastic Security Labs Detect Credential Access with Elastic Security
Laden...
Videos werden geladen ...
Laden...
Beiträge werden geladen ...
Laden...
Videos werden geladen ...
Laden...
Beiträge werden geladen ...
Laden...
Videos werden geladen ...
Laden...
Beiträge werden geladen ...
Laden...
Videos werden geladen ...
Laden...
Beiträge werden geladen ...
Laden...
Videos werden geladen ...
🔖 Gespeicherte Artikel
📂
Keine gespeicherten Artikel vorhanden.
📂 News
⏱️ 3 Min
vor 10 Min
Artikeldaten werden geladen...
tsecurity.de AppOffline-Lesen, Eilmeldungen & 0ms Ladezeit
Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.
Nächster Beitrag
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster:
Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Aktivitäten deiner Analystenlädt…
Neues Thema oder Eilmeldung einreichenReiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung. Heiß diskutierte Einreichungen |
SOCIAL SHARE CARD GENERATOR