[BUG REPORT] Next.js Client-Side Crash (toLowerCase) due to PostHog CORS failures (Email Aliases Affected)

[krik8235]

Description:

A critical client-side exception completely breaks the desktop website authentication flow when logging in.
The crash happens during the magic link evaluation (/login/verify?token=...) and OAuth workflows because the application code assumes a network response object exists when it does not.

Because this is a core client-side crash (NextJS 16), it locks the page completely on a blank screen or a "Signing you in..." loading loop.

Steps to Reproduce:

Attempt to log into Hashnode using a Gmail sub-address alias format (e.g., username+hashnode@gmail.com) via a magic email link from a network node in Vietnam.

Alternatively, attempt to bridge authentication via GitHub OAuth using that same alias on the standard login wrapper page.

The page hangs indefinitely and throws a terminal console error.

Error Console Logs:

The message on the browser:

Application error: a client-side exception has occurred while loading hashnode.com (see the browser console for more information).

The browser console:

Uncaught TypeError: Cannot read properties of undefined (reading 'toLowerCase')
    at 1e9894b20e8d8273.js?dpl=dpl_CxwequaLTruynxTTMhsm4bC7WJnQ:1:105008
    at Array.map (<anonymous>)
    at 1e9894b20e8d8273.js?dpl=dpl_CxwequaLTruynxTTMhsm4bC7WJnQ:1:104990
    at Object.sa [as useMemo] (ae0516f9cf0e7561.js?dpl=dpl_CxwequaLTruynxTTMhsm4bC7WJnQ:1:249722)
    at r.useMemo (ade94519337d7214.js?dpl=dpl_CxwequaLTruynxTTMhsm4bC7WJnQ:1:15463)
    at I (1e9894b20e8d8273.js?dpl=dpl_CxwequaLTruynxTTMhsm4bC7WJnQ:1:104983)
    at ay (ae0516f9cf0e7561.js?dpl=dpl_CxwequaLTruynxTTMhsm4bC7WJnQ:1:240870)
    at sZ (ae0516f9cf0e7561.js?dpl=dpl_CxwequaLTruynxTTMhsm4bC7WJnQ:1:261143)
    at oo (ae0516f9cf0e7561.js?dpl=dpl_CxwequaLTruynxTTMhsm4bC7WJnQ:1:272575)
    at uc (ae0516f9cf0e7561.js?dpl=dpl_CxwequaLTruynxTTMhsm4bC7WJnQ:1:315596)

When using VPN:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://posthog.com. (Reason: CORS request did not succeed). Status code: (null).

Uncaught TypeError: can't access property "toLowerCase", e is undefined
    NextJS 16
    1e9894b20e8d8273.js:1:105006
    Z NextJS
    map self-hosted:163

Root Cause Analysis:

When users connect from certain nodes, the request to ://posthog.com drops, times out, or fails CORS checking, resulting in a null status or undefined response container (e).

The core application code calls .toLowerCase() directly on this unvalidated network parameter string within the Next.js runtime logic.

Because the object is completely missing/undefined, it triggers a catastrophic TypeError that halts all subsequent authentication rendering code.

Expected Behavior:

The telemetry/analytics payload handling should fail gracefully using an explicit null-check or optional chaining (e?.toLowerCase()), allowing the user's primary login and redirect routine to complete successfully even if tracking domains are blocked or unreachable.

Environment Details:

• Operating System: Windows / Mac
• OSBrowsers Tested: Brave, Mozilla Firefox, Google Chrome (All return identical errors). Private/incognito mode doesn't work either.
• Location / ISP: Vietnam. With VPN (Singapore /United State) the error still persists.
• Account Specifics: Sub-address alias (+hashnode) account