Supabase session being reset on every page load

[bbarr]

auth-js/src/GoTrueClient.ts

Line 310 in b045965

if (isBrowser() && this.detectSessionInUrl) {

I notice that because detectSessionInUrl is always true, the auth code is looking for the session in the URL and when it isn't there (every load other than magic link, in my application), it is treating it as an error and resetting.

This wasn't happening the other day, and I don't think I have changed my Supabase version, so it must be a problem with my implementation somehow.. and yet, when I walk through the trace, it clearly gets to this point in the auth library every load, and of course, there is no session info still in the URL, and it kills the session. Can someone better help me understand how detectSessionInUrl is supposed to work?

Thanks!

[Eirmas]

I notice this issue too, and I cannot make sense of their logic.
Their initialize function starts by checking the URL for a session, and if its not there, they remove the data in localstorage, and triggers an "SIGNED_OUT" event. Why?

This basically means every time you refresh the page without a session in the URL, you will be logged out.

[bbarr]

SOLVED. I think I have found a bigger issue. The following code has an early exit that needs to fire in order to avoid losing the session.

auth-js/src/GoTrueClient.ts

Lines 315 to 329 in b045965

	if (isAuthImplicitGrantRedirectError(error)) {
	const errorCode = error.details?.code
	if (
	errorCode === 'identity_already_exists' ||
	errorCode === 'identity_not_found' ||
	errorCode === 'single_identity_not_deletable'
	) {
	return { error }
	}
	}
	// failed login attempt via url,
	// remove old session as in verifyOtp, signUp and signInWith*
	await this._removeSession()

But _getSessionFromUrl() is returning the right AuthImplicitGrantRedirectError, but without the details required to hit the early exit, seen here:

auth-js/src/GoTrueClient.ts

Lines 1443 to 1445 in b045965

	if (!isRedirectFromImplicitGrantFlow && !isRedirectFromPKCEFlow) {
	if (this.flowType === 'implicit') {
	throw new AuthImplicitGrantRedirectError('Not a valid implicit grant flow url.')

Note the lack of a second argument to the error constructor, which is where the details would be.

This commit just happened 11 hours ago: 089c687 which features the new Error call without details.

I can confirm that this is resolved by dropping the SDK version to 2.47.5, which is the one before the last commit.

[harrisrobin]

After hours of debugging, this is why our app keeps logging users out after a few page refreshes! Insane that this made it through as a patch without us changing any supabase versions across our app.

I was able to fix our app by adding the following overrides and reverting back.

  "overrides": {
    "@supabase/auth-js": "2.66.1"
  },

[ufukcam]

I'm using the @nuxtjs/supabase package in my Nuxt app, and I’ve noticed that with detectSessionInUrl set to true, the auth code keeps checking for a session in the URL. Since my app doesn’t rely on magic links often, there’s no session info in the URL, and it ends up resetting the session on every load.

This just started happening recently—I haven’t changed my Supabase or Nuxt package versions. When I trace through the code, it always reaches this point in the auth library and invalidates the session because it can't find the session in the URL.

Can someone clarify how detectSessionInUrl is supposed to behave with the Nuxt package, or if I might have misconfigured something?

Thanks!

[Shooteger]

We have a big Nuxt 3 + Supabase web app.
We encountered the same issue as described here and applied the same fix as by @harrisrobin. After updating packages locally and pushing to the production-testing branch, our application started logging users out on every page route or navigation due to a "Session missing" error.

In our local development environment, the issue was less consistent but still occurred randomly, often after some navigation.

We traced the issue to the latest version of @supabase/auth-js. Reverting to a previous version resolved the problem. Specifically:

The issue does not occur when using @supabase/auth-js version 2.66.1.
Using any version beyond 2.66.1 caused the "Session missing" error.

Relevant packages in our package.json:

"@nuxtjs/supabase": "^1.4.3",
"nuxt": "3.14.1592",

The solution from harris is a good temporary fix. You can add overrides to our package.json to force @supabase/auth-js to use version 2.66.1:

After hours of debugging, this is why our app keeps logging users out after a few page refreshes! Insane that this made it through as a patch without us changing any supabase versions across our app.

I was able to fix our app by adding the following overrides and reverting back.

  "overrides": {
    "@supabase/auth-js": "2.66.1"
  },

[hf]

Reverting the change ASAP. Sorry everyone!

[aigrinder]

Thanks, can someone please help to bump the auth-js package to 2.67.1 in supabase-js? https://github.com/supabase/supabase-js/blob/master/package.json#L43

[onurusluca]

Yep having this now. Been going crazy for 2 days. Couldn't find any solutions.

[czarsbenemoriendi]

I had this issue as well, upon debugging, then downgrading auth-js package the issue was partially resolved. On chromium based browsers (tested in Arc and Chrome) I don't have issues anymore, in Safari the problem persists and is more troublesome.

After investigation I've got an trace that in Safari for below custom storage values aren't kept they are just disappear. By commenting out the lines below and directly assigning this.storage = window.localStorage, the issue was resolved.

auth-js/src/GoTrueClient.ts

Lines 236 to 250 in 9751b80

	if (this.persistSession) {
	if (settings.storage) {
	this.storage = settings.storage
	} else {
	if (supportsLocalStorage()) {
	this.storage = localStorageAdapter
	} else {
	this.memoryStorage = {}
	this.storage = memoryLocalStorageAdapter(this.memoryStorage)
	}
	}
	} else {
	this.memoryStorage = {}
	this.storage = memoryLocalStorageAdapter(this.memoryStorage)
	}

I've passed debugging flag to true in nuxt.config cause, I'm using Nuxt 3 with wrapper for Supabase @nuxt/supabase

In comparison Chrome console

and Safari

In Safari code verifier it's empty, this value should be taken from custom storage because storage is empty or just isn't exist that request return error in Safari. Initialisation login flow should kept tokens and necessary values but they just disappearing