How to fix session_not_found: User session not found in Supabase

Update your Supabase JavaScript and SSR packages to the latest versions. Several fixes have been released to handle session_not_found errors:

npm install @supabase/supabase-js@latest
npm install @supabase/ssr@latest

Check your package.json to ensure you're running:
- @supabase/supabase-js v2.39.0 or later
- @supabase/ssr v0.0.10 or later

Older versions had session refresh bugs that could leave you in a stuck state.

A common cause is setting the Supabase site URL to 127.0.0.1 but accessing your frontend via localhost (or vice versa). These are treated as different origins and cause session validation to fail.

1. Go to your Supabase dashboard
2. Navigate to Project Settings > API
3. Check "Site URL" - it should match exactly how you access your frontend

For local development, use consistent URLs:

# Use localhost consistently:
Site URL: http://localhost:3000

# OR use 127.0.0.1 consistently:
Site URL: http://127.0.0.1:3000

4. Restart your development server after changing the site URL
5. Clear browser cookies for localhost and 127.0.0.1 to force fresh login

On the server side (API routes, middleware), always use auth.getUser() instead of auth.getSession(). The getUser() method makes a request to verify the session server-side, while getSession() just reads local data that could be tampered with.

For Next.js with SSR:

import { createServerClient } from '@supabase/ssr';
import { cookies } from 'next/headers';

export async function GET(request: Request) {
  const cookieStore = await cookies();

  const supabase = createServerClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    process.env.SUPABASE_SERVICE_KEY!,
    {
      cookies: {
        getAll() {
          return cookieStore.getAll();
        },
      },
    }
  );

  const { data: { user }, error } = await supabase.auth.getUser();

  if (error || !user) {
    return new Response(JSON.stringify({ error: 'Unauthorized' }), {
      status: 401,
      headers: { 'Content-Type': 'application/json' },
    });
  }

  return new Response(JSON.stringify({ user }));
}

getUser() always makes a fresh request to verify the session exists, preventing stale session errors.

Wrap authentication calls in error handling that gracefully catches session_not_found and forces a logout:

async function callAuthenticatedEndpoint() {
  try {
    const { data: { user }, error } = await supabase.auth.getUser();

    if (error?.message.includes('session_not_found')) {
      console.warn('Session expired, signing out...');
      await supabase.auth.signOut();
      window.location.href = '/login';
      return;
    }

    if (error) throw error;
    return user;
  } catch (error) {
    console.error('Auth error:', error);
    // Force sign out on any auth error
    try {
      await supabase.auth.signOut();
    } catch (signoutError) {
      // Ignore errors during logout - just clear locally
      localStorage.removeItem('supabase.auth.token');
    }
    window.location.href = '/login';
  }
}

This prevents users from getting stuck in a failed state - they're automatically logged out and redirected to login.

Short JWT expiration times can cause clock skew issues where the token expires before the refresh mechanism can kick in. Increase the expiration time in your Supabase dashboard:

1. Go to Supabase Dashboard > Project Settings > Auth
2. Scroll to JWT Settings
3. Set "JWT expiry limit" (in seconds):
- Minimum: 3600 (1 hour)
- Recommended: 86400 (24 hours) or more for better UX
- Access tokens: Leave at 3600-7200 (1-2 hours)

Access token (JWT) expiry limit: 3600 seconds (1 hour)
Refresh token expiry limit: 604800 seconds (7 days)

Supabase client libraries automatically attempt to refresh sessions before expiry, so longer expiration times give more buffer. The refresh token can be long-lived since it's used server-to-server.

If you're experiencing session_not_found during password recovery specifically, there's a known issue with the standard @supabase/ssr that's fixed in the patched version:

npm install @supabase/ssr@patched

This version fixes issues where the session gets invalidated during the password reset callback flow. After updating, test password recovery end-to-end to ensure the session persists correctly.

Instead of manually checking sessions, let Supabase automatically manage session state with the onAuthStateChange listener:

import { useEffect, useState } from 'react';

export function useCurrentUser() {
  const [user, setUser] = useState(null);
  const [loading, setLoading] = useState(true);

  useEffect(() => {
    // Listen for auth state changes
    const { data: { subscription } } = supabase.auth.onAuthStateChange(
      (event, session) => {
        if (event === 'SIGNED_IN' || event === 'TOKEN_REFRESHED') {
          setUser(session?.user ?? null);
        } else if (event === 'SIGNED_OUT' || event === 'USER_DELETED') {
          setUser(null);
        }
        setLoading(false);
      }
    );

    return () => {
      subscription.unsubscribe();
    };
  }, []);

  return { user, loading };
}

This automatically handles session refreshes and invalidations, reducing the chance of stale session errors.