Supabase•12h ago

Firefox + HTTP/3 causing CORS / NetworkError with Supabase REST/RPC

Hi everyone, I’m having a strange issue using Supabase from a React SPA, but only in Firefox. What happens Frontend: React + Vite using @supabase/supabase-js directly in the browser In Firefox, some Supabase REST/RPC calls fail with: DevTools: Cross-Origin Request Blocked: CORS request did not succeed. Status code: (null) JS error: TypeError: NetworkError when attempting to fetch resource In my logs, these failed requests always die around 30 000 ms I wrap fetch with a 30 s timeout using AbortController, so I know the abort is mine The underlying problem is that, in Firefox, the request never completes before the timeout Same code, same Supabase project: Works perfectly in Chrome and Edge Works perfectly in Firefox if I either call Supabase through a backend proxy (Vercel), or disable HTTP/3 in Firefox (about:config → network.http.http3.enabled = false) So the bad combo seems to be: Firefox plus HTTP/3 plus calling Supabase REST/RPC directly from the browser. What I already checked CORS settings in Supabase, with correct dev and prod origins Supabase API logs look normal, no obvious 4xx/5xx spikes Tried a minimal client with plain createClient (no extra logic) and still see the issue in Firefox, while other calls keep returning 200 normally Question Has anyone seen this behavior before or has an idea how to handle it properly? Is there any known issue with Firefox plus HTTP3 and Supabase REST or RPC? Is there any recommended workaround, for example forcing HTTP2 somewhere, or any best practice on the client side for this case? If anyone has already faced something similar or has a concrete workaround, I would really appreciate any help to unblock this.

26 Replies

garyaustin•12h ago

Any chance you are doing onAuthStateChange with an async call like the important note says here https://supabase.com/docs/reference/javascript/auth-onauthstatechange ? That can cause a hang of a supabase call and it timing related so different browsers may hit or not. I don't really follow what you are describing though.

JavaScript: Listen to auth events | Supabase Docs

Supabase API reference for JavaScript: Listen to auth events

WilsonicOP•12h ago

Thanks Gary for the reply, great point about the async callback deadlock issue! I checked my code and I do have some async callbacks in onAuthStateChange. However, I don't think that's the root cause here because: Works perfectly in Chrome and Edge - if it were a deadlock, it would hang in all browsers, no ? Works when I disable HTTP/3 in Firefox (network.http.http3.enabled = false) - deadlocks are not protocol-dependent The timeout is exactly ~30s - typical deadlocks hang indefinitely, not at a specific timeout The consistent pattern is: Firefox + HTTP/3 + direct Supabase REST calls = 30s timeout That said, I'll fix the async callbacks anyway (wrapping them in setTimeout as recommended) to avoid potential issues. But I believe the core problem is related to how Firefox handles HTTP/3 (QUIC) connections that go idle. Given this behaviour, is there any known issue with Firefox plus HTTP/3 and Supabase REST, or any supported way to force HTTP/2 on the Supabase side so I can properly work around this?

garyaustin•12h ago

It would not hang all browsers as it is very timing specific. A race condition.

WilsonicOP•12h ago

I don't know, is there anything I can show you to try and help me? Any logs? Any code? I greatly appreciate your help in responding to me. I've been trying to solve this problem for several months. The only solution I found was to implement the API via Vercel, and today I came across another solution: disabling HTTP/3 in Firefox. However, it's impossible to ask my users to disable it :011blobcatworried:

garyaustin•12h ago

If my suggestion does not fix it, I have no idea. If you have a supabase call hanging (not going to console.log after) and not generating a network call, that is the only way I have seen that happen. I don't recall anyone ever bringing up http/3 but I did not go and search.

WilsonicOP•12h ago

Okay thanks bro, I'm thinking that my only solution for now will be to use a proxy. I didn't want to have to do this, but it's a solution. Thank you very much. I'll wait to see if anyone has a solution to the problem. I'm willing to pay money if anyone knows how to solve it.

silentworks•12h ago

Have you tried in Firedox with all extensions turned off? I use firefox and have not ran into this issue with my React + Vite + Supabase example. My example repo can be found here https://github.com/silentworks/supabase-by-example/tree/main/react

WilsonicOP•12h ago

Yes, it was one of the first attempts. I thought it might be some extension affecting it, but I still had problems. I even tried using an anonymous guide let me check 1 min I don't know if it would be inconvenient, but if you want, I can upload a version with the proxy disabled for you to test and see what I'm talking about in practice

garyaustin•12h ago

Also please fix your auth event handler. Not clear if you were still planning to do that or not. That alone can break or not in different browsers based on timing. It has happened before where an app was breaking only on one browser.

silentworks•12h ago

Yeah let's try this to just rule out that it's not an issue with your FF itself You can DM me the site url if you don't want to share it publicly here

WilsonicOP•12h ago

I made the correction thanks, like this:

// before
supabase.auth.onAuthStateChange(async (event, session) => {
  await disconnect();  // ⚠️ Chama supabase.removeChannel()
});

// ✅ After
supabase.auth.onAuthStateChange((event, session) => {
  setTimeout(async () => {  // ← Wrapper em setTimeout
    await disconnect();
  }, 0);
});

// before
supabase.auth.onAuthStateChange(async (event, session) => {
  await disconnect();  // ⚠️ Chama supabase.removeChannel()
});

// ✅ After
supabase.auth.onAuthStateChange((event, session) => {
  setTimeout(async () => {  // ← Wrapper em setTimeout
    await disconnect();
  }, 0);
});

sure i will sendo to you and gary let me deploy here in product, 1 min

silentworks•12h ago

I don't think Gary uses FF

garyaustin•12h ago

I do, but I'm not going to debugging this.

silentworks•12h ago

Go and enjoy your thanksgiving Gary

WilsonicOP•12h ago

sure no problem, I'm just going to show you what the problem is, thank you already ❤️ I sent it to you, thank you for your help.

silentworks•12h ago

It worked for me on the first attempt I'm signed up

WilsonicOP•11h ago

:1PepeRain:

silentworks•11h ago

I didn't get any error at all, my developer tools was opened and I was watching the network requests

silentworks•11h ago

silentworks•11h ago

Don't know if this will make a difference but here is my FF version info

WilsonicOP•11h ago

That's strange, I'll run some tests, thank you.

silentworks•10h ago

You can see all the requests to your Supabase instance are http/3 in my screenshot above https://discord.com/channels/839993398554656828/1444015987874599025/1444029778288971896

WilsonicOP•10h ago

oh true :sunglaso: Oh my god, why does this happen to me? WTF?

WilsonicOP•7h ago

@silentworks and @garyaustin Sorry to tag both, but just a quick question: this is a problem I sometimes have with queues. It happens intermittently. Do you have any idea what it could be? It's always around 6 seconds, and it happens with any function call. I don't know if it's a "cold start," but basically it takes that long and then there are no more problems; it stays quiet for a few minutes. thanksss

silentworks•7h ago

You should start a new post with this as it’s unrelated to the original issue, it also makes it more discoverable to others who might be able to help.

WilsonicOP•7h ago

ohhh thanks I will create

Gaming

Programming

Firefox + HTTP/3 causing CORS / NetworkError with Supabase REST/RPC

Did you find this page helpful?