Session tokens stored in localStorage in Vercel

The host does not change where the browser stores a token. Deployment protection on a preview URL is a Vercel login in front of that URL. It is not your app's session cookie. Production still needs the session you actually chose: an HttpOnly cookie from a server-only session, or the provider's documented cookies. Supabase's SSR cookies are not HttpOnly.

Fix XSS sinks in the same pass. HttpOnly stops script from reading that server-only cookie. It does not stop script from calling your API as the signed-in user while the page is open, and it does not apply to a Supabase SSR cookie the browser can read. Cross-site scripting (XSS) is the other half.