What Happens When AI Writes Your Auth Code (And What Can Go Wrong)

AI is good at auth patterns

Modern AI coding tools know JWT, OAuth, session management, and bcrypt. If you ask Cursor to implement login with email/password using NextAuth, you'll get a reasonable implementation. The happy path works.

The edge cases that fail

Auth failures in production are almost never in the happy path. They're in the edge cases: concurrent login from two devices, expired tokens that weren't refreshed, account deletion race conditions, OAuth provider downtime.

The most dangerous AI auth mistake

The most common dangerous mistake is storing JWTs in localStorage (vulnerable to XSS) instead of httpOnly cookies. AI does this frequently because it's simpler code. If any third-party script on your page is compromised, all your users' tokens are stolen.

Token refresh bugs in production

AI implements token refresh for the case where the user is actively using the app. It doesn't handle: tab left open for 8 hours, offline then back online, or refresh token itself expiring. These cause silent auth failures that look like bugs to users.

How to monitor auth failures

ProdFix tracks auth-related errors including 401 spikes, token refresh failures, and session creation errors. If your auth is silently failing, you'll see it in the error dashboard — not in a user support ticket 3 days later.