Can we have an option to suppress the warnings from calling getSession()?

[park-jemin]

While I appreciate the great insight and discussion here, it would be helpful to have an option exposed to allow us to suppress the warnings through the supabase client. It could look something like this:

const client = createSupabaseClient<Database>(
  process.env.SUPABASE_URL!, 
  process.env.SUPABASE_ANON_KEY!, 
  {
    auth: {
      suppressGetSessionWarning: true, // or even something like, `dangerouslySuppressGetSessionWarning`
    },
    cookies: {
      ...
    },
  }
)

I've had to patch the @supabase/auth-js and @supabase/supabase-js packages to get this behavior, but I would appreciate any input and guidance on introducing this to the libraries themselves for users that understand the security risks associated with this and have accounted for it in their architecture.

[rlaphoenix]

Please can we suppress this warning. There's many valid reasons to use this function:

1. Client-side calls dont strictly need this to be validated every time you want what is effectively getUser()'s data because it will be verified on the PostgreST side and any custom APIs wrapping supabase calls.
2. Some backends wouldn't want to use getUser() every time. For example, if you're using Next.js with middleware that authorizes /api/*, then why would you want every HTTP method in every API route to use getUser() and do another API call to Supabase? You could argue to not have the middleware authenticate /api/* and then manually do getUser(), but that's a LOT of code duplication to do the same thing, especially when you won't always need the user data and just want to reject calls without authentication.

In my opinion you shouldn't hand-hold a user with such a warning. If your worry is that developers accidentally use getSession for sensitive tasks instead of getUser, then get rid of getSession and make it more semantic, like supabase.auth.session (Object containing what getSession() contains), or use a less-confusable function name like const token = supabase.auth.useSessionToken() and have token be the decoded token's data with the raw token as token.raw or something.

[mikebdotuk]

Adding my support to this.
Its actually a really nice flexible feature to be able to decode the JWT from both the SSR client and normal client and then use calls to getUser before u do something sensitive on the server.

[JayBox325]

Being able to turn this off would make our debugging process much clearer.

[ddbaron]

@JayBox325 this suppress option is available, see here

[janhesters]

@ddbaron interesting!