Implement safe Supabase auth patterns to prevent deadlocks and session hangs.
npx skills add https://github.com/vassovass/scl-v3 --skill auth-patterns-vassovass
Please help me install this Agent Skill. Skill: auth-patterns Source: https://github.com/vassovass/scl-v3/tree/main/.claude/skills/auth-patterns Command: npx skills add https://github.com/vassovass/scl-v3 --skill auth-patterns-vassovass
Supabase authentication can suffer from deadlocks and session hangs when using certain Auth APIs in web apps. This skill provides safe patterns to avoid these issues and keep authentication flows reliable.
Implement onAuthStateChange in your client app, fetch user data with getUser in API routes, and avoid getSession on the client to prevent deadlocks.
High-intent search queries and answers about installing and using this skill.
Avoid deadlocks by using onAuthStateChange for initial session detection on the client and getUser on server routes instead of getSession on the client. This prevents blocking calls that can hang session state.
getUser fetches the authenticated user and is safe for server routes; getSession retrieves session data but can cause deadlocks on the client. Prefer getUser server-side and onAuthStateChange client-side for reliable authentication flows.
Use onAuthStateChange to listen for auth state changes on the client, cache the session where appropriate, and pair it with getUser calls in API routes. This pattern avoids session hangs and ensures robust token handling across SSR and long-running tasks.
Implement token validation, use cookie-based fallbacks for long-running tasks, ensure proper session cleanup, and separate client-side listeners (onAuthStateChange) from server-side user fetches (getUser) to maintain reliable auth across API routes and server-side rendering.
getSession can deadlock on the client because it may wait for session refresh or validation states that conflict with concurrent auth operations. Using getUser server-side and onAuthStateChange client-side with explicit sequencing eliminates this blocking behavior.
No. Safe Supabase auth patterns rely only on clear code examples, safe fallbacks, and explicit sequencing without external tools. Focus on proper API selection (getUser vs getSession), token handling, and cookie synchronization across your application.
reginadelrio-vadaiIntegrate Supabase Auth with Next.js App Router using @supabase/ssr.
harperaaImplement HMAC-SHA256 CSRF token protection for POST, PUT, and DELETE API routes.
Endsi3gSecure Astro SSR routes and API endpoints with Clerk middleware.
atilladenizImplement passwordless Magic Link authentication with server-side session checks in Next.js 16.
