Skip to content

fix(auth): respect user-provided auth options in createBrowserClient#167

Merged
mandarini merged 1 commit into
supabase:mainfrom
meck93:fix/auth-options-passthrough
Apr 8, 2026
Merged

fix(auth): respect user-provided auth options in createBrowserClient#167
mandarini merged 1 commit into
supabase:mainfrom
meck93:fix/auth-options-passthrough

Conversation

@meck93

@meck93 meck93 commented Mar 4, 2026

Copy link
Copy Markdown
Contributor

Summary

  • createBrowserClient hardcodes autoRefreshToken, detectSessionInUrl, and persistSession after spreading options.auth, overwriting any caller-provided values
  • Use nullish coalescing (??) so explicit options are respected, falling back to current defaults (isBrowser() / true) when not set
  • Adds tests verifying passthrough of all three options

Fixes #108

autoRefreshToken, detectSessionInUrl, persistSession were hardcoded,
overwriting any user-provided options.auth.* values. Use nullish
coalescing to fall back to defaults only when not explicitly set.

Fixes supabase#108

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Mar 4, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: f7016364-fc54-4e48-837f-6bcda2fb637b

📥 Commits

Reviewing files that changed from the base of the PR and between ea85814 and 9255cd8.

📒 Files selected for processing (2)
  • src/createBrowserClient.spec.ts
  • src/createBrowserClient.ts

📝 Walkthrough

Summary by CodeRabbit

  • New Features

    • Browser client now supports configuration of authentication options, including automatic token refresh, session detection from URL parameters, and session persistence settings, with sensible defaults.
  • Tests

    • Added test coverage for authentication configuration options and default behavior validation.

Walkthrough

The PR addresses a bug where user-provided auth options were being ignored when creating a browser client. The createBrowserClient.ts now uses nullish coalescing to respect user-provided values for autoRefreshToken, detectSessionInUrl, and persistSession while maintaining browser-appropriate defaults when these options are not specified. Corresponding test coverage has been added to verify that these options are properly passed through to the client.

Assessment against linked issues

Objective Addressed Explanation
Respect autoRefreshToken: false in auth options [#108]
Respect detectSessionInUrl: false in auth options [#108]
Respect persistSession: false in auth options [#108]
Maintain browser-appropriate defaults when auth options not provided [#108]

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@meck93

meck93 commented Mar 4, 2026

Copy link
Copy Markdown
Contributor Author

@mandarini could you have a look at it? thanks!

@mandarini mandarini merged commit 5f04837 into supabase:main Apr 8, 2026
5 checks passed
mandarini pushed a commit that referenced this pull request Apr 8, 2026
🤖 I have created a release *beep* *boop*
---


## [0.10.1](v0.10.0...v0.10.1)
(2026-04-08)


### Bug Fixes

* **auth:** respect user-provided auth options in createBrowserClient
([#167](#167))
([5f04837](5f04837))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: supabase-releaser[bot] <223506987+supabase-releaser[bot]@users.noreply.github.com>
@meck93 meck93 deleted the fix/auth-options-passthrough branch May 25, 2026 22:16
mandarini pushed a commit that referenced this pull request Jun 9, 2026
🤖 I have created a release *beep* *boop*
---


## [0.12.0](v0.11.0...v0.12.0)
(2026-06-09)


### Features

* adds `cookies.encode` option allowing minimal cookie sizes
([#126](#126))
([cf38b22](cf38b22))
* bump `cookie` to 1.0.2
([#113](#113))
([b4a77b4](b4a77b4))
* **cookies:** add clearAuthCookiesAtScopes migration helper
([#240](#240))
([4e47249](4e47249))
* full rewrite using `getAll` and `setAll` cookie methods
([#1](#1))
([b6ae192](b6ae192))
* improve cookie chunk handling via base64url+length encoding
([#90](#90))
([6deb687](6deb687))
* pass cache headers to setAll to prevent CDN caching of auth responses
([#176](#176))
([14962d2](14962d2))
* publish SSR under deprecated auth-helpers package names
([#127](#127))
([e8b6102](e8b6102))
* release workflow RC versioning and publish reliability
([#164](#164))
([81e68f4](81e68f4))
* update CI so it runs on release as well
([#33](#33))
([4517996](4517996))
* update supabase-js to latest
([#133](#133))
([d65044d](d65044d))
* update supabase-js to latest
([#145](#145))
([08bf7d6](08bf7d6))
* upgrade cookie dependency and cleanup imports
([#77](#77))
([9524528](9524528))


### Bug Fixes

* add @types/cookies to dependencies
([#63](#63))
([47e5f16](47e5f16))
* add `create*Client` string in `x-client-info`
([#85](#85))
([f271acc](f271acc))
* allow cookies encode without getAll/setAll on browser client
([#213](#213))
([89f3f28](89f3f28)),
closes [#170](#170)
* allow use of `createBrowserClient` without `window` present
([#20](#20))
([27d868d](27d868d))
* **auth:** respect user-provided auth options in createBrowserClient
([#167](#167))
([5f04837](5f04837))
* check chunkedCookie is string in server client
([#57](#57))
([549fe62](549fe62))
* **ci:** remove packageManager field
([#197](#197))
([6bf0226](6bf0226))
* cookies console warnings
([#136](#136))
([64ff6b3](64ff6b3))
* deprecate `parse`, `serialize` exports for more useful functions
([#14](#14))
([0b5f881](0b5f881))
* enable tree-shaking for browser bundles
([#216](#216))
([f009d71](f009d71))
* fix `createBrowserClient` deprecation tsdoc
([#17](#17))
([1df70ad](1df70ad))
* force release ([#98](#98))
([66710e8](66710e8))
* re-apply update CI so it runs on release as well
([#49](#49))
([51d5a43](51d5a43))
* **release:** pin npm to 11.5.2 so OIDC trusted publisher works
([#249](#249))
([4af89f7](4af89f7))
* remove optional dependencies
([#41](#41))
([a48fe6f](a48fe6f))
* remove usage of internal type params
([#123](#123))
([8f3e89e](8f3e89e))
* revert "update CI so it runs on release as well"
([#44](#44))
([9d0e859](9d0e859))
* **revert:** "feat: improve cookie chunk handling via base64url+length
encoding ([#90](#90))"
([#100](#100))
([2ea8e23](2ea8e23))
* set `max-age` default cookie option to 400 days
([#54](#54))
([f4ed2e0](f4ed2e0))
* set cookies for password recovery event
([#32](#32))
([7dc1837](7dc1837))
* set cookies when mfa challenge is verified
([#27](#27))
([c217f53](c217f53))
* **tsconfig:** set explicit rootDir to silence TS6059 in consumer IDEs
([#211](#211))
([a77ee8a](a77ee8a)),
closes [#209](#209)
* update conventional commits ci to use main instead of master
([#31](#31))
([bebce89](bebce89))
* update README session docs
([#159](#159))
([b859905](b859905))
* update type, remove unused imports, define AuthEvent type
([#47](#47))
([4f4a375](4f4a375))
* use skipAutoInitialize to prevent SSR token refresh race condition
([#131](#131))
([0b7be28](0b7be28))
* validate base64-prefixed chunked cookies decode to valid JSON
([#210](#210))
([302cc0e](302cc0e))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: supabase-releaser[bot] <223506987+supabase-releaser[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

autoRefreshSession: false does nothing with createBrowserClient

2 participants