Session Mix-up in Production Next.js App Hosted on IIS After Switching Azure App Registration Platform to “Web”

Hi,

I have a Next.js (TypeScript) app hosted on IIS using Azure AD authentication. In production, when I restart the app, user sessions get mixed up — for example, one user sees another user’s data or gets logged in as someone else.

This issue never happened in the lab environment. The only difference between lab and production setup is:

Lab: Azure App Registration platform = Mobile and Desktop application

Production: Azure App Registration platform = Web

Could switching the Azure AD platform type cause this session mix-up? Or is it more related to ARR affinity, session cookie, or NextAuth/session handling on IIS?

• Hosting setup summary:
  • IIS reverse proxy → localhost:8080
  • ARR enabled (proxy + SSL offloading)
  • Next.js app listens on port 8080