💻 Six hours lost to one trailing slash in an environment variable

Six hours yesterday on a login bug that only happened on the deployed site and never on my laptop. I rewrote the auth callback twice, cleared cookies about thirty times, and even blamed the browser for a while. Logs showed the user returning from the login page with no session, like the cookie never existed. At 11pm I was reading old forum answers about same site cookie settings and getting more confused. Then I checked the environment variables on the hosting dashboard for the fifth time and looked at the site URL. There was a trailing slash at the end of it. One slash, in a field I had pasted from my notes. The login service was redirecting to a slightly different address than the one my site lived on. That tiny difference was enough for the cookie to be dropped. I stared at the dashboard for a full minute. I removed the slash, redeployed, and the login worked on the first try, which felt rude after six hours. My first feeling was not relief, it was a quiet anger at myself and at the dashboard. I kept thinking about all the code I had rewritten for no reason, because the old code was fine. I reverted two commits that night and the diff was a lot bigger than the one character fix. What annoys me is that I knew to check the config first. Everyone says check the config first. I skipped it because it felt too simple to be the problem and my code felt more suspicious. A senior at my last internship used to say the bug is always in the last place you want to look. I used to think that was a joke. Now I have it written on a sticky note next to my monitor. So my new habit is a checklist, five lines long, that I go through before touching any real code. URLs, keys, trailing spaces, redirect addresses, and whether the same thing works locally with production settings. It takes four minutes and it would have saved me an entire evening and most of a packet of biscuits. What is on your own checklist before you start rewriting things? I would like to steal a few.

Hulk's trailing space story sounds painfully familiar, mine was a Windows line ending hiding inside a copied key. The login failed only on the server and I blamed the hosting company for two days. Sam, the sticky note is a nice touch, I keep one that says check the boring thing first. It is slightly embarrassing how often that note ends up being the answer.

Mine was a redirect URL with http instead of https, and the error just said invalid callback. I lost a whole Saturday in a cafe in Banjara Hills before a friend glanced at the screen. On your checklist, I would add logging the site URL with quotes around it, never the keys. Quotes make hidden slashes and spaces visible, at least they did for me.

A trailing slash cost me a whole weekend once, except mine was a trailing space in an API key. The error message said invalid token, so I regenerated the token four times before checking the pasted value. Now I paste secrets into a plain text editor first and look at the cursor position at the end. Cheap trick, but it has saved me twice since then.