Explore our curated collection of articles, insights, and stories about Supabase.
The warning fires on every image, upload and WebSocket that touches <ref>.supabase.co in Firefox. It is Cloudflare's bot-management cookie being scoped to a Public Suffix List domain, so every browser drops it. Here is the verified cause, the cases where the noise hides a real 403 or auth bug, and how to tell them apart in two minutes.
Both of these will authenticate a user perfectly well, so comparing sign-in methods is a waste of your afternoon. The decision that actually costs you later is where authorisation is enforced. Supabase Auth puts a user id inside the database so policies can use it; Better Auth puts sessions in a table you own and leaves enforcement to your application. Pick the wrong one and you are rewriting your security model, not swapping a library.
`AuthSessionMissingError: Auth session missing!` is not a bug report — it is Supabase telling you, accurately, that the client you called had no session to work with. The hard part is that the same message covers a signed-out user, a server client that never received your cookies, a middleware that forgot to forward them, and a `getUser()` call that fired before the session was restored. Each has a different fix.
Your app loads, the session arrives, and then every Supabase call after it hangs forever. No error, no rejected promise, no network request — the query simply never returns and the loading spinner stays up until someone reloads the page. If you fetch a profile inside your `onAuthStateChange` callback, this is a documented deadlock in supabase-js, and the fix is one line.
A view over `auth.users`, a policy that joins it, or a client query against it all fail the same way: `ERROR: 42501: permission denied for schema auth`. It is not a missing GRANT you forgot — Supabase keeps the `auth` schema out of reach of the API roles deliberately, and granting your way in is the one fix you should not apply. The supported route is a security definer function.
Every RLS leak I have seen shipped the same way: the policy was tested in a context that does not enforce it. The Supabase SQL editor runs as a privileged role, the service key carries `BYPASSRLS`, and the table owner is exempt from its own policies unless you say otherwise. Three green checks, zero enforcement. This is the procedure that actually tests a policy — plus the two Postgres flags that decide whether your test means anything.
The Firestore error "PERMISSION_DENIED: Missing or insufficient permissions" never tells you which rule rejected you. Here is how to find out — and the seven causes that account for almost every occurrence.
Your auth looks correct but users can bypass it. The bug: getSession() in server code reads from local storage without revalidating the token against the Auth server.
The redirect lands on your production domain instead of the preview URL, or you get a "redirect URL not allowed" error. Here is the exact Supabase dashboard config and the Vercel env var pattern.
A Supabase Realtime subscription can say SUBSCRIBED and still receive nothing. This fix walks through RLS, filter syntax, stale React subscriptions, paused projects, and broadcast versus postgres_changes confusion.
If you are fetching whole result sets just to count them, you are paying for bandwidth and latency you do not need. Supabase already returns counts in query metadata.
This Storage error almost never means Supabase is broken. It usually means your upload path, your RLS policy, or your use of `upsert` does not match how Storage actually authorizes writes.
The Supabase service_role key bypasses every RLS policy in your database. That is exactly what you want for admin jobs, migrations, and cron tasks — and exactly what an attacker wants if it ever leaks to the client bundle. Here is how to set up the admin client in Next.js, where it is safe to use, and the three mistakes that put a root credential in your JS bundle.
Learn the exact steps to grant the right permissions in Supabase and stop the 'permission denied for schema public' error from breaking your app.
Supabase Auth returns precise error codes — `invalid_credentials`, `weak_password`, `same_password`, `email_not_confirmed` — but most apps collapse them all into "Something went wrong." Here's the full TypeScript enum, a typed handler, and the UX pattern that doubles signup completion.
If your Supabase query returns `infinite recursion detected in policy for relation "X"`, your RLS policy is querying the same table it protects. Here's exactly why it loops, and three production-grade fixes that don't leak data.
We tested all four major auth solutions across 50+ real-world scenarios in production. Here is the honest comparison nobody else gives you — including the middleware vulnerability that changed everything, migration costs, and which one actually scales.
Eleven recurring traps that surface once Supabase Auth is wired into a production Next.js app — drawn from public Supabase docs, the SSR guide, and the postmortems the community has published.
Slow Supabase queries kill your app feel and inflate your bill. Here are the six causes I keep seeing in production apps, and the exact SQL and code fixes for each one.
Build a complete full-stack application with Next.js and Supabase from scratch. Authentication, database, CRUD operations, and deployment — all in 20 minutes.
Supabase vs Firebase — which backend should you pick in 2026? We compare pricing, performance, developer experience, and scalability with real benchmarks and code examples.
Thousands of developers are migrating from Firebase to Supabase. Here is why — with real migration stories, cost savings, and a step-by-step guide to make the switch.
Master RLS debugging techniques. Learn how to identify, diagnose, and fix Row Level Security policy issues that block data access in production.
After shipping multiple production apps with Next.js and Supabase, here are the decisions that cost the most time to undo — and what I'd do instead from day one.
RLS failures don't throw errors — they return empty results. Here is exactly how to find and fix the most common Row Level Security bugs in Supabase before they reach production.
Seven recurring patterns from production runs of Next.js + Supabase, and the fixes that prevented the most common failures.
How we went from failing enterprise security requirements to passing SOC 2 compliance in 6 weeks. The authentication architecture patterns that actually work at scale.
Avoid common Supabase Realtime pitfalls that cause memory leaks, missed updates, and performance issues. Learn real-world solutions from production applications.
Avoid these critical mistakes when building with Next.js and Supabase. Learn from real-world errors that cost developers hours of debugging and discover proven solutions.
Supabase auth sessions mysteriously disappearing after page refresh? Learn the exact cause and fix it in 5 minutes with this tested solution.
Auth errors crashing your Next.js middleware? Learn how to handle Supabase auth errors gracefully with proper error handling patterns.
Auth redirect not working after Supabase sign-in? Here are the three root causes and the exact fixes — callback route, redirect URL allowlist, and router.refresh().
Compare Supabase and Firebase authentication features, pricing, performance, and developer experience. Learn which backend solution fits your Next.js project best.
Email confirmations not sending from Supabase? Learn the exact causes and fixes for SMTP, template, and configuration issues in 10 minutes.
Find stories that matter to you.
