What Happens When Two Cookies Have the Same Name for Authentication?

It ultimately depends on the server's implementation. If it's your own server, you have the freedom to define which cookie to use. If you’re hitting a third-party server, it’s best to ask the owner how they handle scenarios like this.

The cookie handling isn’t completely standardized, but there are guidelines. For example, the RFC suggests that cookies with longer paths should come before those with shorter paths, and if two cookies have equal-length paths, the one created first should take precedence. However, not all user agents follow this strictly, meaning the behavior can vary. For instance, in PHP, it often defaults to the last cookie if there are duplicates.

You might want to consider hashing the cookie names to keep them unique; this way, they are guaranteed to be different while still being parseable. It could help prevent confusion outright!

Having two cookies with the same name is generally poor practice, and you should really avoid it if possible. However, if both cookies are sent to the server, the server can read both values. Typically, if it were me, I’d implement the endpoint in such a way that it would indicate that the user isn’t authenticated properly. Browsers and servers behave inconsistently in this area because the RFC guidelines suggest practices rather than enforce strict rules.