Posting this because the symptom looks like an application bug and took us a
while to trace back to the tunnel.
Symptom
An infinite redirect loop on an authenticated route. The app starts OAuth,
returns, finds no session, and starts again. Only in a normal browser profile;
incognito is always fine.
Cause
Each shopify hydrogen dev --customer-account-push run gets a fresh random
subdomain on tryhydrogen.dev. Session cookies are host-only, so each tunnel
leaves one behind that nothing cleans up: a server can only delete cookies for
its own host or a parent domain, and the old tunnel is gone anyway.
Chromium’s CookieMonster stores cookies keyed on the registrable domain
(eTLD+1), not the exact host, with a limit of 180 cookies per eTLD+1,
purged to 150 and evicting least-recently-used first.
tryhydrogen.dev is not on the Public Suffix List, so its eTLD+1 is itself.
Every tunnel you have ever used shares one 180-cookie bucket. Once it fills,
a freshly written session cookie is the most likely thing evicted, since it is
the least recently used cookie in a jar of older ones.
The tell in a HAR is cookieCount dropping sharply between two requests with no
deletion and no server-side session write in between.
Workaround
Clear all data for tryhydrogen.dev.
Possible fixes
- A short
Max-Ageon tunnel session cookies, so dead tunnels expire
instead of accumulating. Smallest change that works. - A stable tunnel hostname per project, which removes the accumulation
entirely. - Tunnels on a Public Suffix List domain, giving each its own eTLD+1 and
cookie bucket, plus real isolation between concurrent tunnels.
Environment
Hydrogen 2026.4.3, Chrome, shopify hydrogen dev --customer-account-push.
Has anyone else run into this? Mainly wondering whether a short Max-Age would
be an acceptable change.