Node starter - validateAuthCallback fails when setting USE_ONLINE_TOKENS = false

[conspireagency]

Issue summary

Using fresh scaffold of the latest Shopify node app (vite + express one) and changing to OFFLINE tokens 0auth fails.

Expected behavior

0authcallback should not throw an error. App install should proceed seamlessly.

Actual behavior

What actually happens?

CookieNotFound [Error]: Cannot complete OAuth process. Could not find an OAuth cookie for shop url: capptesting.myshopify.com -or- InvalidOAuthError: Invalid OAuth callback.

Steps to reproduce the problem

1. Use the latest Shopify node app scaffolding (vite + express one). Completely fresh app.
2. Update in web/index.js const USE_ONLINE_TOKENS = false;
3. Attempt to install app on store, after approving app check console for errors.
4. Compare to seamless install

For me, the first time it threw the CookieNotFound error. After uninstalling the app and trying again it produced the InvalidOAuthError.

Poking around into this I noticed is that after updating USE_ONLINE_TOKENS to false the "/api/auth" route gets hit twice on initial install producing two slightly different redirectUrls (different state). This doesn't happen when USE_ONLINE_TOKENS is set to true.

UPDATE tried on different browsers and for me it was most reproducible on Chrome. Safari had no issues.