Backend/src/lib/Authentication.ts

@@ -71,7 +71,10 @@ export function normalizeUsername(username: string): string {
 
 /** Compute the cookie domain scope from the configured DOMAIN. */
 export function cookieDomain(domain: string): string {
-	if (domain === "localhost") return "localhost";
+	// IP addresses cannot have a registrable parent domain. Treating the first
+	// octet as a subdomain would turn 100.74.255.106 into 74.255.106 and make
+	// browser sessions unusable on direct-IP test/self-hosted deployments.
+	if (domain === "localhost" || /^(?:\d{1,3}\.){3}\d{1,3}$/.test(domain)) return domain;
 	if (domain.split(".").length > 2) {
 		// Subdomain deployment: scope to the registrable parent domain.
 		return domain.split(".").slice(1).join(".");