SvelteKit + @supabase/ssr - Missing Set-Cookie Headers on Successful Login

Jackson_Action · 2025-05-07T15:51:44.493Z

**Problem:** I'm using SvelteKit (Svelte 4) with @supabase/ssr for authentication. My client-side supabase.auth.signInWithPassword call succeeds (returns 200 OK from /auth/v1/token with user/session data in the JSON response), but the Response Headers are missing the Set-Cookie headers for the sb-* tokens. This prevents the browser from storing session cookies, causing subsequent server-side requests (handled by hooks.server.ts using createServerClient) to fail authentication checks (event.locals.getSession() returns no session). **Troubleshooting Done:** Verified PUBLIC_SUPABASE_URL/ANON_KEY and VITE_PUBLIC_... env vars are correct and match dashboard. Confirmed Supabase Auth Settings: "Enable Session Management" appears implicitly ON (no master toggle found), Redirect URLs include https://localhost:5173/**. Using standard @supabase/ssr pattern in hooks.server.ts. Upgraded project to Pro Plan - issue persists. Client-side fetch calls include credentials: 'include'. **Question:** Why would the Supabase Auth endpoint not send back Set-Cookie headers on a successful login, despite returning session data in the response body? Is there a configuration I might be missing? I'm using https and have CORS setup as well. not sure if there are other relevant settings? Any insights would be greatly appreciated! This has been driving me crazy.

J

Jackson_ActionOP•5/7/25, 3:54 PM

Relevant Code:

src/hooks.server.ts:
import { PUBLIC_SUPABASE_URL, PUBLIC_SUPABASE_ANON_KEY } from '$env/static/public';
import { createServerClient } from '@supabase/ssr';
import { type Handle, redirect } from '@sveltejs/kit';
import { sequence } from '@sveltejs/kit/hooks';
import type { CookieOptions } from '@supabase/ssr';


const supabaseHandler: Handle = async ({ event, resolve }) => {
    event.locals.supabase = createServerClient(
        PUBLIC_SUPABASE_URL,
        PUBLIC_SUPABASE_ANON_KEY,
        {
            cookies: {
                get: (key: string) => event.cookies.get(key),
                set: (key: string, value: string, options: CookieOptions) => {
                    event.cookies.set(key, value, { ...options, path: '/' });
                },
                remove: (key: string, options: CookieOptions) => {
                    event.cookies.delete(key, { ...options, path: '/' });
                },
            },
        }
    );

    event.locals.safeGetSession = async () => {
        const { data: { session }, error: getSessionError } = await event.locals.supabase.auth.getSession();
        if (getSessionError || !session) {
            return { session: null, user: null };
        }
        const { data: { user }, error: getUserError } = await event.locals.supabase.auth.getUser();
        if (getUserError) {
            return { session: null, user: null };
        }
        return { session, user };
    };

    return resolve(event, {
        filterSerializedResponseHeaders(name) {
            return name === 'content-range' || name === 'x-supabase-edge-function-execution-time';
        },
    });
};

const authGuard: Handle = async ({ event, resolve }) => {
    const { session, user } = await event.locals.safeGetSession();
    event.locals.session = session;
    event.locals.user = user;

    // Example route protection (adjust paths as needed):
    // if (!event.locals.session && event.url.pathname.startsWith('/private')) {
    //     redirect(303, '/Login');
    // }
    // if (event.locals.session && event.url.pathname === '/Login') {
    //     redirect(303, '/');
    // }

    return resolve(event);
};

const mainHandler: Handle = async ({ event, resolve }) => {
    // Cron jobs, CSRF, CORS logic here (omitted for brevity)
    const response = await resolve(event);
    // CORS Headers setting here (omitted for brevity)
    return response;
};

export const handle = sequence(supabaseHandler, authGuard, mainHandler);

// Server startup processes here (omitted for brevity)

src/hooks.server.ts:
import { PUBLIC_SUPABASE_URL, PUBLIC_SUPABASE_ANON_KEY } from '$env/static/public';
import { createServerClient } from '@supabase/ssr';
import { type Handle, redirect } from '@sveltejs/kit';
import { sequence } from '@sveltejs/kit/hooks';
import type { CookieOptions } from '@supabase/ssr';


const supabaseHandler: Handle = async ({ event, resolve }) => {
    event.locals.supabase = createServerClient(
        PUBLIC_SUPABASE_URL,
        PUBLIC_SUPABASE_ANON_KEY,
        {
            cookies: {
                get: (key: string) => event.cookies.get(key),
                set: (key: string, value: string, options: CookieOptions) => {
                    event.cookies.set(key, value, { ...options, path: '/' });
                },
                remove: (key: string, options: CookieOptions) => {
                    event.cookies.delete(key, { ...options, path: '/' });
                },
            },
        }
    );

    event.locals.safeGetSession = async () => {
        const { data: { session }, error: getSessionError } = await event.locals.supabase.auth.getSession();
        if (getSessionError || !session) {
            return { session: null, user: null };
        }
        const { data: { user }, error: getUserError } = await event.locals.supabase.auth.getUser();
        if (getUserError) {
            return { session: null, user: null };
        }
        return { session, user };
    };

    return resolve(event, {
        filterSerializedResponseHeaders(name) {
            return name === 'content-range' || name === 'x-supabase-edge-function-execution-time';
        },
    });
};

const authGuard: Handle = async ({ event, resolve }) => {
    const { session, user } = await event.locals.safeGetSession();
    event.locals.session = session;
    event.locals.user = user;

    // Example route protection (adjust paths as needed):
    // if (!event.locals.session && event.url.pathname.startsWith('/private')) {
    //     redirect(303, '/Login');
    // }
    // if (event.locals.session && event.url.pathname === '/Login') {
    //     redirect(303, '/');
    // }

    return resolve(event);
};

const mainHandler: Handle = async ({ event, resolve }) => {
    // Cron jobs, CSRF, CORS logic here (omitted for brevity)
    const response = await resolve(event);
    // CORS Headers setting here (omitted for brevity)
    return response;
};

export const handle = sequence(supabaseHandler, authGuard, mainHandler);

// Server startup processes here (omitted for brevity)

src/hooks.server.ts:
import { PUBLIC_SUPABASE_URL, PUBLIC_SUPABASE_ANON_KEY } from '$env/static/public';
import { createServerClient } from '@supabase/ssr';
import { type Handle, redirect } from '@sveltejs/kit';
import { sequence } from '@sveltejs/kit/hooks';
import type { CookieOptions } from '@supabase/ssr';


const supabaseHandler: Handle = async ({ event, resolve }) => {
    event.locals.supabase = createServerClient(
        PUBLIC_SUPABASE_URL,
        PUBLIC_SUPABASE_ANON_KEY,
        {
            cookies: {
                get: (key: string) => event.cookies.get(key),
                set: (key: string, value: string, options: CookieOptions) => {
                    event.cookies.set(key, value, { ...options, path: '/' });
                },
                remove: (key: string, options: CookieOptions) => {
                    event.cookies.delete(key, { ...options, path: '/' });
                },
            },
        }
    );

    event.locals.safeGetSession = async () => {
        const { data: { session }, error: getSessionError } = await event.locals.supabase.auth.getSession();
        if (getSessionError || !session) {
            return { session: null, user: null };
        }
        const { data: { user }, error: getUserError } = await event.locals.supabase.auth.getUser();
        if (getUserError) {
            return { session: null, user: null };
        }
        return { session, user };
    };

    return resolve(event, {
        filterSerializedResponseHeaders(name) {
            return name === 'content-range' || name === 'x-supabase-edge-function-execution-time';
        },
    });
};

const authGuard: Handle = async ({ event, resolve }) => {
    const { session, user } = await event.locals.safeGetSession();
    event.locals.session = session;
    event.locals.user = user;

    // Example route protection (adjust paths as needed):
    // if (!event.locals.session && event.url.pathname.startsWith('/private')) {
    //     redirect(303, '/Login');
    // }
    // if (event.locals.session && event.url.pathname === '/Login') {
    //     redirect(303, '/');
    // }

    return resolve(event);
};

const mainHandler: Handle = async ({ event, resolve }) => {
    // Cron jobs, CSRF, CORS logic here (omitted for brevity)
    const response = await resolve(event);
    // CORS Headers setting here (omitted for brevity)
    return response;
};

export const handle = sequence(supabaseHandler, authGuard, mainHandler);

// Server startup processes here (omitted for brevity)

src/hooks.server.ts:
import { PUBLIC_SUPABASE_URL, PUBLIC_SUPABASE_ANON_KEY } from '$env/static/public';
import { createServerClient } from '@supabase/ssr';
import { type Handle, redirect } from '@sveltejs/kit';
import { sequence } from '@sveltejs/kit/hooks';
import type { CookieOptions } from '@supabase/ssr';


const supabaseHandler: Handle = async ({ event, resolve }) => {
    event.locals.supabase = createServerClient(
        PUBLIC_SUPABASE_URL,
        PUBLIC_SUPABASE_ANON_KEY,
        {
            cookies: {
                get: (key: string) => event.cookies.get(key),
                set: (key: string, value: string, options: CookieOptions) => {
                    event.cookies.set(key, value, { ...options, path: '/' });
                },
                remove: (key: string, options: CookieOptions) => {
                    event.cookies.delete(key, { ...options, path: '/' });
                },
            },
        }
    );

    event.locals.safeGetSession = async () => {
        const { data: { session }, error: getSessionError } = await event.locals.supabase.auth.getSession();
        if (getSessionError || !session) {
            return { session: null, user: null };
        }
        const { data: { user }, error: getUserError } = await event.locals.supabase.auth.getUser();
        if (getUserError) {
            return { session: null, user: null };
        }
        return { session, user };
    };

    return resolve(event, {
        filterSerializedResponseHeaders(name) {
            return name === 'content-range' || name === 'x-supabase-edge-function-execution-time';
        },
    });
};

const authGuard: Handle = async ({ event, resolve }) => {
    const { session, user } = await event.locals.safeGetSession();
    event.locals.session = session;
    event.locals.user = user;

    // Example route protection (adjust paths as needed):
    // if (!event.locals.session && event.url.pathname.startsWith('/private')) {
    //     redirect(303, '/Login');
    // }
    // if (event.locals.session && event.url.pathname === '/Login') {
    //     redirect(303, '/');
    // }

    return resolve(event);
};

const mainHandler: Handle = async ({ event, resolve }) => {
    // Cron jobs, CSRF, CORS logic here (omitted for brevity)
    const response = await resolve(event);
    // CORS Headers setting here (omitted for brevity)
    return response;
};

export const handle = sequence(supabaseHandler, authGuard, mainHandler);

// Server startup processes here (omitted for brevity)

src/lib/supabaseClient.ts (Client-side):

import { createClient } from '@supabase/supabase-js';

const supabaseUrl = import.meta.env.VITE_PUBLIC_SUPABASE_URL || '';
const supabaseAnonKey = import.meta.env.VITE_PUBLIC_SUPABASE_ANON_KEY || '';

export const supabase = createClient(supabaseUrl, supabaseAnonKey);

// getRedirectUrl function omitted for brevity

import { createClient } from '@supabase/supabase-js';

const supabaseUrl = import.meta.env.VITE_PUBLIC_SUPABASE_URL || '';
const supabaseAnonKey = import.meta.env.VITE_PUBLIC_SUPABASE_ANON_KEY || '';

export const supabase = createClient(supabaseUrl, supabaseAnonKey);

// getRedirectUrl function omitted for brevity

import { createClient } from '@supabase/supabase-js';

const supabaseUrl = import.meta.env.VITE_PUBLIC_SUPABASE_URL || '';
const supabaseAnonKey = import.meta.env.VITE_PUBLIC_SUPABASE_ANON_KEY || '';

export const supabase = createClient(supabaseUrl, supabaseAnonKey);

// getRedirectUrl function omitted for brevity

import { createClient } from '@supabase/supabase-js';

const supabaseUrl = import.meta.env.VITE_PUBLIC_SUPABASE_URL || '';
const supabaseAnonKey = import.meta.env.VITE_PUBLIC_SUPABASE_ANON_KEY || '';

export const supabase = createClient(supabaseUrl, supabaseAnonKey);

// getRedirectUrl function omitted for brevity

J

Jackson_ActionOP•5/7/25, 3:56 PM

src/routes/Login/+page.svelte (Relevant Script Part):

<script lang="ts">
    import { supabase } from '$src/lib/supabaseClient';
    import { goto } from '$app/navigation';
    import { sessionStore } from '$src/lib/stores/auth_state_store';
    // Other imports omitted

    let email = '';
    let password = '';

    async function handleSubmit() {
        console.log(`🚀 Login handleSubmit: Attempting login for email: ${email}`);
        try {
            // This call succeeds (returns 200 OK + session data in body)
            // BUT the response headers are missing Set-Cookie
            const { data, error } = await supabase.auth.signInWithPassword({
                email,
                password
            });

            console.log('🚀 Login Response - Error:', error);
            console.log('🚀 Login Response - Data:', data);

            if (error) {
                console.error('❌ Login Failed:', error.message);
            } else if (data?.user && data?.session) {
                console.log(`✅ Login Successful! User ID: ${data.user.id}`);
                sessionStore.set(data.session);
                // Post-login logic (e.g., initializeUserMessages) omitted for brevity
                await goto('/');
            } else {
                 console.warn('Login Warning: Success response but no user/session data.');
            }
        } catch (catchError: any) {
             console.error('❌ Login Exception in handleSubmit:', catchError);
        }
    }
</script>

<script lang="ts">
    import { supabase } from '$src/lib/supabaseClient';
    import { goto } from '$app/navigation';
    import { sessionStore } from '$src/lib/stores/auth_state_store';
    // Other imports omitted

    let email = '';
    let password = '';

    async function handleSubmit() {
        console.log(`🚀 Login handleSubmit: Attempting login for email: ${email}`);
        try {
            // This call succeeds (returns 200 OK + session data in body)
            // BUT the response headers are missing Set-Cookie
            const { data, error } = await supabase.auth.signInWithPassword({
                email,
                password
            });

            console.log('🚀 Login Response - Error:', error);
            console.log('🚀 Login Response - Data:', data);

            if (error) {
                console.error('❌ Login Failed:', error.message);
            } else if (data?.user && data?.session) {
                console.log(`✅ Login Successful! User ID: ${data.user.id}`);
                sessionStore.set(data.session);
                // Post-login logic (e.g., initializeUserMessages) omitted for brevity
                await goto('/');
            } else {
                 console.warn('Login Warning: Success response but no user/session data.');
            }
        } catch (catchError: any) {
             console.error('❌ Login Exception in handleSubmit:', catchError);
        }
    }
</script>

<script lang="ts">
    import { supabase } from '$src/lib/supabaseClient';
    import { goto } from '$app/navigation';
    import { sessionStore } from '$src/lib/stores/auth_state_store';
    // Other imports omitted

    let email = '';
    let password = '';

    async function handleSubmit() {
        console.log(`🚀 Login handleSubmit: Attempting login for email: ${email}`);
        try {
            // This call succeeds (returns 200 OK + session data in body)
            // BUT the response headers are missing Set-Cookie
            const { data, error } = await supabase.auth.signInWithPassword({
                email,
                password
            });

            console.log('🚀 Login Response - Error:', error);
            console.log('🚀 Login Response - Data:', data);

            if (error) {
                console.error('❌ Login Failed:', error.message);
            } else if (data?.user && data?.session) {
                console.log(`✅ Login Successful! User ID: ${data.user.id}`);
                sessionStore.set(data.session);
                // Post-login logic (e.g., initializeUserMessages) omitted for brevity
                await goto('/');
            } else {
                 console.warn('Login Warning: Success response but no user/session data.');
            }
        } catch (catchError: any) {
             console.error('❌ Login Exception in handleSubmit:', catchError);
        }
    }
</script>

<script lang="ts">
    import { supabase } from '$src/lib/supabaseClient';
    import { goto } from '$app/navigation';
    import { sessionStore } from '$src/lib/stores/auth_state_store';
    // Other imports omitted

    let email = '';
    let password = '';

    async function handleSubmit() {
        console.log(`🚀 Login handleSubmit: Attempting login for email: ${email}`);
        try {
            // This call succeeds (returns 200 OK + session data in body)
            // BUT the response headers are missing Set-Cookie
            const { data, error } = await supabase.auth.signInWithPassword({
                email,
                password
            });

            console.log('🚀 Login Response - Error:', error);
            console.log('🚀 Login Response - Data:', data);

            if (error) {
                console.error('❌ Login Failed:', error.message);
            } else if (data?.user && data?.session) {
                console.log(`✅ Login Successful! User ID: ${data.user.id}`);
                sessionStore.set(data.session);
                // Post-login logic (e.g., initializeUserMessages) omitted for brevity
                await goto('/');
            } else {
                 console.warn('Login Warning: Success response but no user/session data.');
            }
        } catch (catchError: any) {
             console.error('❌ Login Exception in handleSubmit:', catchError);
        }
    }
</script>

J

Jackson_ActionOP•5/7/25, 3:57 PM

src/routes/api/outgoingSmsMessages/+server.ts (Example Failing API):

import type { RequestEvent } from '@sveltejs/kit';
// Other imports (Twilio, helpers) omitted

const FILE_PATH = 'src/routes/api/outgoingSmsMessages/+server.ts';

export async function POST(event: RequestEvent) {
    const functionName = 'POST';
    const supabase = event.locals.supabase; // Get client from locals

    if (!supabase) {
        // Handle missing client
        return new Response(/* ... */);
    }

    try {
        const requestBody = await event.request.json();
        const { user_id: userIdFromRequest /* ... other fields */ } = requestBody;

        // This fails because cookies weren't set after login
        const session = await event.locals.getSession(); // Uses event.locals.supabase internally

        if (!session || session.user.id !== userIdFromRequest) {
            console.error(`❌ ${FILE_PATH} ~ ${functionName} ~ Authentication error or User ID mismatch. Request user_id: ${userIdFromRequest}, Session user_id: ${session?.user?.id}`);
            // This is where it currently fails with "Session user_id: undefined"
            return new Response(
                JSON.stringify({ error: 'Authentication error or user ID mismatch.' }),
                { status: 401, headers: { 'Content-Type': 'application/json' } }
            );
        }
        const authenticatedUserId = session.user.id;
        console.log(`ℹ️ ${FILE_PATH} ~ ${functionName} ~ Request validated for authenticated user: ${authenticatedUserId}.`);

        // ... rest of API logic (fetch client_id using authenticated 'supabase' instance, send Twilio message, insert into DB) ...
        // Example: const resolvedClientId = await fetchClientIdByPhoneNumber(to, authenticatedUserId, supabase);

        return new Response(/* Success response */);

    } catch (error: any) {
        // Error handling
        return new Response(/* Error response */);
    }
}

import type { RequestEvent } from '@sveltejs/kit';
// Other imports (Twilio, helpers) omitted

const FILE_PATH = 'src/routes/api/outgoingSmsMessages/+server.ts';

export async function POST(event: RequestEvent) {
    const functionName = 'POST';
    const supabase = event.locals.supabase; // Get client from locals

    if (!supabase) {
        // Handle missing client
        return new Response(/* ... */);
    }

    try {
        const requestBody = await event.request.json();
        const { user_id: userIdFromRequest /* ... other fields */ } = requestBody;

        // This fails because cookies weren't set after login
        const session = await event.locals.getSession(); // Uses event.locals.supabase internally

        if (!session || session.user.id !== userIdFromRequest) {
            console.error(`❌ ${FILE_PATH} ~ ${functionName} ~ Authentication error or User ID mismatch. Request user_id: ${userIdFromRequest}, Session user_id: ${session?.user?.id}`);
            // This is where it currently fails with "Session user_id: undefined"
            return new Response(
                JSON.stringify({ error: 'Authentication error or user ID mismatch.' }),
                { status: 401, headers: { 'Content-Type': 'application/json' } }
            );
        }
        const authenticatedUserId = session.user.id;
        console.log(`ℹ️ ${FILE_PATH} ~ ${functionName} ~ Request validated for authenticated user: ${authenticatedUserId}.`);

        // ... rest of API logic (fetch client_id using authenticated 'supabase' instance, send Twilio message, insert into DB) ...
        // Example: const resolvedClientId = await fetchClientIdByPhoneNumber(to, authenticatedUserId, supabase);

        return new Response(/* Success response */);

    } catch (error: any) {
        // Error handling
        return new Response(/* Error response */);
    }
}

import type { RequestEvent } from '@sveltejs/kit';
// Other imports (Twilio, helpers) omitted

const FILE_PATH = 'src/routes/api/outgoingSmsMessages/+server.ts';

export async function POST(event: RequestEvent) {
    const functionName = 'POST';
    const supabase = event.locals.supabase; // Get client from locals

    if (!supabase) {
        // Handle missing client
        return new Response(/* ... */);
    }

    try {
        const requestBody = await event.request.json();
        const { user_id: userIdFromRequest /* ... other fields */ } = requestBody;

        // This fails because cookies weren't set after login
        const session = await event.locals.getSession(); // Uses event.locals.supabase internally

        if (!session || session.user.id !== userIdFromRequest) {
            console.error(`❌ ${FILE_PATH} ~ ${functionName} ~ Authentication error or User ID mismatch. Request user_id: ${userIdFromRequest}, Session user_id: ${session?.user?.id}`);
            // This is where it currently fails with "Session user_id: undefined"
            return new Response(
                JSON.stringify({ error: 'Authentication error or user ID mismatch.' }),
                { status: 401, headers: { 'Content-Type': 'application/json' } }
            );
        }
        const authenticatedUserId = session.user.id;
        console.log(`ℹ️ ${FILE_PATH} ~ ${functionName} ~ Request validated for authenticated user: ${authenticatedUserId}.`);

        // ... rest of API logic (fetch client_id using authenticated 'supabase' instance, send Twilio message, insert into DB) ...
        // Example: const resolvedClientId = await fetchClientIdByPhoneNumber(to, authenticatedUserId, supabase);

        return new Response(/* Success response */);

    } catch (error: any) {
        // Error handling
        return new Response(/* Error response */);
    }
}

import type { RequestEvent } from '@sveltejs/kit';
// Other imports (Twilio, helpers) omitted

const FILE_PATH = 'src/routes/api/outgoingSmsMessages/+server.ts';

export async function POST(event: RequestEvent) {
    const functionName = 'POST';
    const supabase = event.locals.supabase; // Get client from locals

    if (!supabase) {
        // Handle missing client
        return new Response(/* ... */);
    }

    try {
        const requestBody = await event.request.json();
        const { user_id: userIdFromRequest /* ... other fields */ } = requestBody;

        // This fails because cookies weren't set after login
        const session = await event.locals.getSession(); // Uses event.locals.supabase internally

        if (!session || session.user.id !== userIdFromRequest) {
            console.error(`❌ ${FILE_PATH} ~ ${functionName} ~ Authentication error or User ID mismatch. Request user_id: ${userIdFromRequest}, Session user_id: ${session?.user?.id}`);
            // This is where it currently fails with "Session user_id: undefined"
            return new Response(
                JSON.stringify({ error: 'Authentication error or user ID mismatch.' }),
                { status: 401, headers: { 'Content-Type': 'application/json' } }
            );
        }
        const authenticatedUserId = session.user.id;
        console.log(`ℹ️ ${FILE_PATH} ~ ${functionName} ~ Request validated for authenticated user: ${authenticatedUserId}.`);

        // ... rest of API logic (fetch client_id using authenticated 'supabase' instance, send Twilio message, insert into DB) ...
        // Example: const resolvedClientId = await fetchClientIdByPhoneNumber(to, authenticatedUserId, supabase);

        return new Response(/* Success response */);

    } catch (error: any) {
        // Error handling
        return new Response(/* Error response */);
    }
}

J

Jackson_ActionOP•5/7/25, 3:57 PM

src/app.d.ts:

import type { Session, SupabaseClient, User } from '@supabase/supabase-js';

declare global {
  namespace App {
    interface Locals {
      supabase: SupabaseClient<any, "public">; // Use specific DB types if generated
      safeGetSession: () => Promise<{ session: Session | null; user: User | null }>;
      session: Session | null;
      user: User | null;
    }
    interface PageData {
      session: Session | null;
    }
    // interface Error {}
    // interface PageState {}
    // interface Platform {}
  }
}
export {};

import type { Session, SupabaseClient, User } from '@supabase/supabase-js';

declare global {
  namespace App {
    interface Locals {
      supabase: SupabaseClient<any, "public">; // Use specific DB types if generated
      safeGetSession: () => Promise<{ session: Session | null; user: User | null }>;
      session: Session | null;
      user: User | null;
    }
    interface PageData {
      session: Session | null;
    }
    // interface Error {}
    // interface PageState {}
    // interface Platform {}
  }
}
export {};

import type { Session, SupabaseClient, User } from '@supabase/supabase-js';

declare global {
  namespace App {
    interface Locals {
      supabase: SupabaseClient<any, "public">; // Use specific DB types if generated
      safeGetSession: () => Promise<{ session: Session | null; user: User | null }>;
      session: Session | null;
      user: User | null;
    }
    interface PageData {
      session: Session | null;
    }
    // interface Error {}
    // interface PageState {}
    // interface Platform {}
  }
}
export {};

import type { Session, SupabaseClient, User } from '@supabase/supabase-js';

declare global {
  namespace App {
    interface Locals {
      supabase: SupabaseClient<any, "public">; // Use specific DB types if generated
      safeGetSession: () => Promise<{ session: Session | null; user: User | null }>;
      session: Session | null;
      user: User | null;
    }
    interface PageData {
      session: Session | null;
    }
    // interface Error {}
    // interface PageState {}
    // interface Platform {}
  }
}
export {};

J

Jackson_ActionOP•5/7/25, 3:59 PM

again thank you so much for any help with this, feel like I'm setting everything up correctly.

J

j4•5/7/25, 7:31 PM

In

src/lib/supabaseClient.ts

src/lib/supabaseClient.ts

src/lib/supabaseClient.ts

src/lib/supabaseClient.ts, your

import { createClient } from '@supabase/supabase-js';

import { createClient } from '@supabase/supabase-js';

import { createClient } from '@supabase/supabase-js';

import { createClient } from '@supabase/supabase-js'; should be

import { createBrowserClient } from '@supabase/ssr';

import { createBrowserClient } from '@supabase/ssr';

import { createBrowserClient } from '@supabase/ssr';

import { createBrowserClient } from '@supabase/ssr';

J

j4•5/7/25, 7:32 PM

@Jackson_Action this misconfiguration is causing the session to be stored in browser localStorage instead of cookies.

J

Jackson_ActionOP•5/8/25, 5:30 PM

Awesomel, thank you I'll give that a try right now

J

Jackson_ActionOP•5/8/25, 7:59 PM

That was it, thank you!

SvelteKit + @supabase/ssr - Missing Set-Cookie Headers on Successful Login

Similar Threads

Similar Threads

Similar Threads