{"id":14968765,"url":"https://github.com/supabase/ssr","last_synced_at":"2026-05-07T09:02:31.555Z","repository":{"id":242928344,"uuid":"805369223","full_name":"supabase/ssr","owner":"supabase","description":"Supabase clients for use in server-side rendering frameworks.","archived":false,"fork":false,"pushed_at":"2026-04-28T12:10:22.000Z","size":341,"stargazers_count":190,"open_issues_count":48,"forks_count":21,"subscribers_count":19,"default_branch":"main","last_synced_at":"2026-04-29T20:03:30.846Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/supabase.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"github":["supabase"],"patreon":null,"open_collective":null,"ko_fi":null,"tidelift":null,"community_bridge":null,"liberapay":null,"issuehunt":null,"otechie":null,"custom":null}},"created_at":"2024-05-24T12:32:36.000Z","updated_at":"2026-04-27T16:31:50.000Z","dependencies_parsed_at":"2026-03-18T16:02:27.910Z","dependency_job_id":null,"html_url":"https://github.com/supabase/ssr","commit_stats":{"total_commits":37,"total_committers":9,"mean_commits":4.111111111111111,"dds":0.4864864864864865,"last_synced_commit":"95245282e67ce649b58504e3a98200797b7cd8f1"},"previous_names":["supabase/ssr"],"tags_count":56,"template":false,"template_full_name":null,"purl":"pkg:github/supabase/ssr","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/supabase%2Fssr","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/supabase%2Fssr/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/supabase%2Fssr/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/supabase%2Fssr/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/supabase","download_url":"https://codeload.github.com/supabase/ssr/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/supabase%2Fssr/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32582852,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-03T06:36:36.687Z","status":"ssl_error","status_checked_at":"2026-05-03T06:36:09.306Z","response_time":103,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-09-24T13:40:30.915Z","updated_at":"2026-05-04T14:01:42.847Z","avatar_url":"https://github.com/supabase.png","language":"TypeScript","funding_links":["https://github.com/sponsors/supabase"],"categories":[],"sub_categories":[],"readme":"# Supabase clients for use in SSR frameworks\n\n\u003e **Package Consolidation Notice**: This package replaces the deprecated `@supabase/auth-helpers-*` packages. All framework-specific auth-helpers packages have been consolidated into `@supabase/ssr` for better maintenance and consistency.\n\n## Overview\n\nThis package provides a framework-agnostic way to use the [Supabase JavaScript library](https://supabase.com/docs/reference/javascript/introduction) in server-side rendering (SSR) frameworks.\n\n## Installation\n\n```bash\nnpm i @supabase/ssr\n```\n\n## Deprecated Packages\n\nThe following packages have been deprecated and consolidated into `@supabase/ssr`:\n\n- `@supabase/auth-helpers-nextjs` → Use `@supabase/ssr`\n- `@supabase/auth-helpers-react` → Use `@supabase/ssr`\n- `@supabase/auth-helpers-remix` → Use `@supabase/ssr`\n- `@supabase/auth-helpers-sveltekit` → Use `@supabase/ssr`\n\nIf you're currently using any of these packages, please update your dependencies to use `@supabase/ssr` directly.\n\n## Documentation\n\nPlease refer to the [official server-side rendering guides](https://supabase.com/docs/guides/auth/server-side) for the latest best practices on using this package in your SSR framework of choice.\n\n## Known patterns and limitations\n\n### `getSession()` vs `getUser()` vs `getClaims()`\n\n`getSession()` returns the session directly from cookies — no network call is\nmade. The user object it contains is **not verified by the Auth server** and\nmust not be used for authorization decisions; a malicious client could craft a\ncookie with a spoofed user ID. **Do not use `getSession()` for authorization decisions.**\n\n`getClaims()` validates the access token either locally (using the project's\nJWKS endpoint for asymmetric keys) or by calling the Auth server, and returns\nthe verified JWT claims. Use it when you need to gate access to resources but\ndon't need a fresh user record from the database.\n\n`getUser()` contacts the Supabase Auth server on every call and returns the\nmost up-to-date user record, including any changes made since the token was\nissued. Use it when you need fresh user data (e.g. checking current roles,\nemail, or whether the session is still active server-side).\n\n### Concurrent requests with the same expired session\n\nSupabase refresh tokens are single-use. If two requests arrive simultaneously\nwith the same expired session cookie (e.g. from two browser tabs opening at\nthe same time), both will attempt a token refresh. The second request's\nrefresh will fail because the token was already consumed by the first. The\nsecond request will receive `session: null` until the browser syncs the\nupdated cookie from the first response.\n\nThe **middleware pattern** mitigates this for the common case: middleware runs\nonce per navigation and refreshes the session before the page renders, so\nsubsequent requests within the same navigation see a valid token. For parallel\nrequests (e.g. parallel `fetch()` calls from the client), handle `null`\nsessions gracefully and retry or re-authenticate as needed.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsupabase%2Fssr","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsupabase%2Fssr","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsupabase%2Fssr/lists"}