Error to Logout - Inconsistent 403 Forbidden

[mmarinhomac]

Bug report

Describe the bug

I'm realizing that this happens after a new deployment, perhaps, I'm already logged in to the platform in production, I can recover the session normally but when I click to log out, it returns 403 AuthApiError: Session from session_id claim in JWT does not exist, localhost this does not happen.

Since I already have the local session, I tried to handle this 403 to manually pass refresh_token to supabase.auth.refreshSession({ refresh_token }) and somehow reset everything so that my clients don't get stuck in this situation, but it returns 400 bad request, but I check in the request the refresh_token is present in the payload.

To Reproduce

The only specific scenario observed was that I performed a deployment before, my front-end is hosted on Vercel.

Expected behavior

Logout

Screenshots

System information

• OS: Windows
• Browser chrome desktop
• Version of supabase-js: ^2.38.5
• Version of Node.js: 19.0.0

[ysemennikov]

Hey! Just got absolutely the same error. Have deployed to Vercel and now catch the bug (on both production and localhost).

Well, it seems like I have successfully logged out on the backend of Supabase, but the session hasn't been removed on the frontend.

const user = useSupabaseUser();
const supabase = useSupabaseClient();

if (user.value) {
  console.log(user.value) // logs a User
  const { error } = await supabase.auth.signOut();
  console.log('error', error); // AuthApiError: Session from session_id claim in JWT does not exist
}

System information

• Nuxt 3 + official Supabase module ("@nuxtjs/supabase": "^1.2.2")
• Node.js 20
• Browser: Chrome Desktop
• OS: MacOS

[epavanello]

Same issue to me on https://avatarify-ai.com/
Any solution or workaround?

[Randallcp]

I'm getting the same exact error message using supabase-swift, so the issue doesn't appear to be isolated to this library.

[Garett-MacGowan]

I'm experiencing a similar issue with edge function authorization.

[epavanello]

I solved upgrading the dependencies

[mmarinhomac]

A quick update, supabase support got back to me the following message:

You can fix this by:
- Manually ignore 403s returned and just clear the local session stored on the browser.
- Upgrade to supabase-js v2.43.1 which contains the changes to ignore the 403s returned.

I try to repeat the error, but it happens intermittently, in the end I ended up updating to the latest version ^2.43.4 ⚡️

"clear the local session" I don't know how I would do this since the supabase session is stored in cookies secure and http , which cannot be modified or deleted due to the browser's security policies...