The bug that looked like a browser problem
A redirect turned into a file download in Safari. The cause was a header, not the browser.
A magic-link email would open, and Safari would prompt to download a file instead of signing in. Chrome was fine. Firefox was fine. Just Safari, and only sometimes.
The route in question lived under /api, returned a redirect, and the response carried X-Content-Type-Options: nosniff sitewide. Safari treats a redirect response with a JSON content type and nosniff set as something to save, not something to follow, on a direct navigation.
Nothing was wrong with the redirect itself. The fix was smaller than the symptom: point email links at a plain page instead of an /api route. A page navigation never hits that Safari behavior, nosniff or not.
The lesson
If a bug only reproduces in one browser and only on a direct link click, check what content type and headers a redirect is carrying before touching the auth logic. The browser was reading the response exactly as told.
Try it
If you serve redirects from an API route with nosniff set, send the link a real page instead. Safari was never the problem. It was just the messenger.