User gets automatically logged out on page refresh

[onurusluca]

Hi. I don't know when this started happening(probably after 1.4.4 update) but after logging in, on page refresh I am just logged out automatically. Browsing normally nothing happens until reloading the page.

Happens on all browsers, didn't change any code at all, just did some package updates. I only use redirect false as setting, nothing else. No middleware or logout logic.

Anyone having this problem?

[onurusluca]

Found this thread. After the problem is solved we need a quick update on the module too.

https://github.com/supabase/auth-js/issues/995

Opened #442

[yakubka]

This is a known issue with cookie-based session persistence in the module. On page refresh the server renders the page and reads the session from the auth cookie. If the cookie is not found or is not parsed correctly during SSR, the module resets auth state to null, and the client picks that up after hydration and treats the user as logged out.

A few things to check based on the symptoms you described.

First, open the browser devtools on the Application tab and look at the cookies for your domain. After logging in you should see a cookie named sb--auth-token. If that cookie has a short expiry, SameSite=None without Secure, or a path that does not cover your app routes, it may not be sent on the SSR request.

Second, check your nuxt.config.ts for the supabase module options. Try explicitly setting the cookie options:

supabase: {
  cookieOptions: {
    maxAge: 60 * 60 * 8,
    sameSite: "lax",
    secure: process.env.NODE_ENV === "production",
    path: "/",
  },
}

Third, if you have redirectOptions configured with redirect enabled, confirm that the route you are refreshing is not listed under exclude. The module redirects unauthenticated users and if the auth state is lost during SSR, the redirect fires before the client can restore the session from the cookie.

Finally, check whether the issue only happens on routes that use useSupabaseUser or similar server-side auth checks. If it only happens on those routes and not on routes that skip the check, the problem is in how the SSR request reads the cookie rather than in the auth state itself.