nextjs-supabase-ssr

To configure Supabase authentication in Next.js App Router for server-side rendering, use distinct factory functions to create context-specific Supabase clients for Server Components, Server Actions, Route Handlers, and Client Components. This ensures correct HTTP-only cookie handling for session persistence across all rendering contexts.

The Supabase user returns undefined in Next.js Server Components when using a client-side Supabase instance instead of a server-side one. You must create a Supabase client configured to read HTTP-only cookies within the Server Component to properly access the authentication state.

To protect routes with Supabase and Next.js middleware without causing redirect loops, ensure your middleware correctly refreshes the authentication session and only redirects unauthenticated users from protected paths. Properly managing cookie updates in middleware prevents infinite redirect cycles common in SSR setups.

Yes, you need different Supabase clients for Server Actions and Route Handlers in Next.js 15. Server Actions require a client configured for read-write cookie manipulation to update sessions, while Route Handlers and Server Components need specific client configurations to correctly manage HTTP-only cookies securely.

The best way to handle Supabase auth state changes and real-time subscriptions in Next.js SSR is using a Client Component Supabase client. This dedicated client correctly manages browser-side auth state and resolves common real-time subscription failures caused by misconfigured server-side cookie contexts.