Use this guide when browser login, MFA verification, or session refresh keeps failing in the public product path.
Check the visible failure type first
Treat these as different problems:
- invalid MFA code,
- expired MFA challenge,
- rate-limited MFA or resend cooldown,
- generic login/session failure after proxy or cookie changes.
Do not collapse them into one “auth is broken” report.
Check browser-safe session dependencies
Confirm that:
- cookies are set for the published domain you are actually using,
- reverse-proxy headers such as
x-forwarded-hostandx-forwarded-protostay correct, - system clocks are not drifting on the auth and gateway hosts.
Check whether the failure is product or deployment
- If MFA shows an invalid or expired challenge, retry through the normal browser flow first.
- If login loops after proxy changes, treat the proxy or cookie boundary as the likely problem.
- If OAuth or login errors expose only a safe product code, capture that code instead of guessing the backend text.
Decide the next move
- Fix proxy and cookie posture before asking users to retry repeatedly.
- If the failure is still visible after posture recovery, capture the safe error code and the exact published URL before escalating.