netlify/edge-functions/redirect.ts redirects /admin/* to ADMIN_DOMAIN only when the request hostname equals PUBLIC_DOMAIN exactly. Production sites answer on several hostnames (custom domain, *.netlify.app, aliases), so whichever ones aren't PUBLIC_DOMAIN serve the admin SPA directly on an origin Clerk doesn't trust — editors get a sign-in that silently fails (origin_invalid) instead of a redirect.
Live example: marronage-prod.netlify.app/admin/ → 301 to marronage.performant.studio/admin/, but www.cimarrongeographies.org/admin/ → 200, no redirect. Found while onboarding PADP production, where the same mismatch existed in reverse.
Suggested fix: invert the check — redirect /admin-prefixed requests on any hostname that isn't ADMIN_DOMAIN to ADMIN_DOMAIN, and keep the existing admin-domain → PUBLIC_DOMAIN inverse redirect for non-admin paths. PUBLIC_DOMAIN then only names the canonical public host rather than acting as the sole redirect trigger.
netlify/edge-functions/redirect.tsredirects/admin/*toADMIN_DOMAINonly when the request hostname equalsPUBLIC_DOMAINexactly. Production sites answer on several hostnames (custom domain,*.netlify.app, aliases), so whichever ones aren'tPUBLIC_DOMAINserve the admin SPA directly on an origin Clerk doesn't trust — editors get a sign-in that silently fails (origin_invalid) instead of a redirect.Live example:
marronage-prod.netlify.app/admin/→ 301 tomarronage.performant.studio/admin/, butwww.cimarrongeographies.org/admin/→ 200, no redirect. Found while onboarding PADP production, where the same mismatch existed in reverse.Suggested fix: invert the check — redirect
/admin-prefixed requests on any hostname that isn'tADMIN_DOMAINtoADMIN_DOMAIN, and keep the existing admin-domain →PUBLIC_DOMAINinverse redirect for non-admin paths.PUBLIC_DOMAINthen only names the canonical public host rather than acting as the sole redirect trigger.