Next.js Supabase Auth: 40% of sessions dropped in 24h
на канале: TheCodeForge
40% of sessions dropped in 24h — no auth middleware, tokens expired hourly. Root cause: Without middleware, expired access tokens were never refreshed. The fix: Add Supabase auth middleware using the `@supabase/ssr` refresh pattern.
A production war story from the TheCodeForge Next.js series — the incident, why it happened, and the exact fix.
⏳ Timestamps:
0:00 - Cold open: Session duration dropped from 8 hours to 52 minutes
0:12 - Version Compatibility
0:59 - Production Caveat: Cookie Size Limits
1:26 - Intro
1:36 - What Is Supabase Auth?
1:56 - Package Setup
2:25 - Browser Client Factory
2:32 - Server Client Factory
2:46 - Middleware Client Factory
3:02 - Middleware: Token Refresh
3:34 - Server Actions: Auth
4:01 - Sign In & OAuth
4:12 - OAuth Callback Route
4:27 - Route Protection
5:00 - Layout Guard & Provider
5:11 - Row Level Security
5:39 - PKCE & Session Persistence
6:08 - Server-Side OAuth
6:36 - Real-Time Subscriptions
7:03 - Serverless Functions
7:32 - Session duration dropped from 8 hours to 52 minutes
7:55 - Missing middleware token refresh
8:05 - The Fix
8:27 - ⚠ Gotcha: No middleware.ts at project root
8:42 - ⚠ Gotcha: Using browser client on server
8:55 - ⚠ Gotcha: Using getSession() instead of getUser()
9:09 - Debugging Guide
9:26 - Interview Questions
10:00 - FAQ
10:28 - Key Takeaways
10:45 - Next up
11:11 - Wrap-up
👉 Full article + code: https://thecodeforge.io/javascript/su...
⏭ Next up: tRPC v11 + Next.js 16: Complete Setup and Best Practices
#nextjs #javascript