Symfony's default session_fixation_strategy (migrate) regenerated the session ID on every authenticated request, breaking concurrent API calls from the SPA — only the first request succeeded, all others got 401. The login controller already calls $session->migrate(true) explicitly, so disabling automatic migration is safe. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>