Cookie and session lifecycle

How Supabase auth cookies are set, refreshed, and cleared—and why signed-out home loads skip history inserts.

Authentication is not only the sign-in form—it is the HttpOnly cookie chain that lets server routes know which feed mappings and history rows belong to you. Expired sessions explain sudden “default demo feeds” on the home page and missing history inserts even when probes are healthy.

Sequence diagram from sign-in through cookie set, SSR fetch, and history insert
Sign-in establishes session cookies consumed by SSR routes and history insert logic.

Lifecycle stages

  1. Sign-in — Supabase returns session; server sets scoped cookies.
  2. SSR requests — middleware validates before dashboard render.
  3. Refresh — silent token rotation before expiry when configured.
  4. Sign-out — cookies cleared; subsequent loads are anonymous.

Impact on data pipeline

History saves on authenticated home loads—see data flow overview. Guest visitors read public demo feeds via probe fetch without writing rows. Session bugs resemble data gaps in charts.

Security pairing

Combine with middleware auth and Supabase auth flow. Admin routes additionally check group membership.