Findings No. 41
Vite's silent port fallback can move your dev server off the origin your auth trusts
When its port is taken, Vite quietly moves to the next free one. Better Auth's trustedOrigins then rejected every dev request. strictPort makes the conflict fail loudly.
When the port Vite wants is already taken, it does not stop. It quietly starts on the next free port, and anything configured to trust a specific origin stops trusting your dev server.
Several of our projects use Vite's default ports, so Replicator's dev server kept landing on whichever port happened to be free. Better Auth builds its trustedOrigins list from the configured public URL, which was the production URL, so it rejected every request that came from the drifted local origin. In the browser this looked like a CSP-style block rather than an auth problem, and nothing about it said "your port changed".
The fix had two parts. vite.config.ts now sets server: { port: 5183, strictPort: true }, so a port conflict stops the dev server at startup with a clear error instead of drifting. And src/lib/auth.ts adds http://localhost:5183 to trustedOrigins alongside the production URL, which is harmless in production because real requests never come from localhost. lj-website pins its dev port with strictPort as well.
The general rule: if any part of your stack trusts a fixed origin, pin the dev server's port with strictPort. Silent fallback is convenient until something downstream depends on the address.
Receipt: Replicator v3.66.6 (vite.config.ts strictPort, trustedOrigins in src/lib/auth.ts; FINDINGS.md, "Auth and sessions").