Auth session missing — getSession() returns null

Supabase can’t find the user’s session.

Why this happens

Supabase stores auth tokens in cookies (SSR) or localStorage (SPA). When getSession() returns null, it means the client can’t find or read those tokens. This commonly occurs when using the wrong client type for your environment, when cookies aren’t being forwarded in server-side requests, or when the session token has expired without a refresh.

Fix 1: Check your Supabase client setup

// ❌ Creating a new client on every request
const supabase = createClient(url, key);

// ✅ Use createServerClient for SSR
import { createServerClient } from '@supabase/ssr';
const supabase = createServerClient(url, key, { cookies });

Fix 2: Check cookie configuration

// Next.js middleware
const supabase = createServerClient(url, key, {
  cookies: {
    get: (name) => request.cookies.get(name)?.value,
    set: (name, value, options) => response.cookies.set({ name, value, ...options }),
    remove: (name, options) => response.cookies.set({ name, value: '', ...options }),
  },
});

Fix 3: Refresh the session

const { data: { session } } = await supabase.auth.getSession();
if (!session) {
  const { data } = await supabase.auth.refreshSession();
}

Alternative solutions

Use onAuthStateChange to reactively handle session changes instead of polling with getSession():

supabase.auth.onAuthStateChange((event, session) => {
  if (event === 'SIGNED_OUT') {
    redirect('/login');
  }
});

Prevention

• Always use @supabase/ssr for server-rendered apps — the vanilla createClient doesn’t handle cookies.
• Set cookieOptions.maxAge to match your JWT expiry to avoid stale sessions.

Related: Supabase RLS Policy fix · How OAuth Actually Works · Supabase vs Firebase · What is PostgreSQL