PatchVault › Errors › Supabase auth-helpers → @supabase/ssr
Using the user object as returned from supabase.auth.getSession() or from some supabase.auth.onAuthStateChange() events could be insecure!
supabase-js logs this on the server when you read session.user from getSession(), because that value comes straight from the cookie and is not verified.
Check your code free (runs in your browser)
The box is pre-filled with a sample that triggers this error. Paste your own file to check it. Nothing leaves this page.
Or scan your whole repo locally (free, stdlib Python, read-only):
python3 <(curl -fsSL https://patchvault-81y.pages.dev/starters/supabase-ssr-scan.py) .Why it happens
The full message continues: "This value comes directly from the storage medium (usually cookies on the server) and may not be authentic. Use supabase.auth.getUser() instead which authenticates the data by contacting the Supabase Auth server."
Manual fix
// server code: verify the user instead of trusting the cookie
const { data: { user }, error } = await supabase.auth.getUser()
if (!user) redirect('/login')Verify
Re-run your install/build and re-scan the file above. The finding should be gone. The paid fixer applies the same change across a repo: --dry-run shows the diff, --apply keeps a .bak of each file, and --rollback restores them.
Sources
Related errors
- @supabase/auth-helpers-nextjs is deprecated: fix
- @supabase/ssr get/set/remove cookies deprecated
- Supabase "Invalid Refresh Token: Refresh Token Not Found"
- Supabase "Invalid Refresh Token: Session Expired"
- Cookies can only be modified in a Server Action (Supabase)
Full guide and free terminal scanner: Supabase auth-helpers → @supabase/ssr. Last checked 2026-10-31.