PatchVault › Errors › Supabase auth-helpers → @supabase/ssr

Please specify `getAll` and `setAll` cookie methods instead of the `get`, `set` and `remove`. These will not be supported in the next major version.

Your editor or TypeScript shows this deprecation on createServerClient / createBrowserClient because the cookies option still uses the old get / set / remove methods.

Check your code free (runs in your browser)

The box is pre-filled with a sample that triggers this error. Paste your own file to check it. Nothing leaves this page.

Or scan your whole repo locally (free, stdlib Python, read-only):

python3 <(curl -fsSL https://patchvault-81y.pages.dev/starters/supabase-ssr-scan.py) .

Why it happens

The @supabase/ssr source marks the single-cookie methods as deprecated. Its docs warn that implementing getAll and setAll incorrectly causes random logouts, early session termination and extra refresh-token requests.

Manual fix

createServerClient(url, key, {
  cookies: {
    getAll() { return request.cookies.getAll() },
    setAll(cookiesToSet) {
      cookiesToSet.forEach(({ name, value }) => request.cookies.set(name, value))
      response = NextResponse.next({ request })
      cookiesToSet.forEach(({ name, value, options }) => response.cookies.set(name, value, options))
    },
  },
})

Verify

Re-run your install/build and re-scan the file above. The finding should be gone. The paid fixer applies the same change across a repo: --dry-run shows the diff, --apply keeps a .bak of each file, and --rollback restores them.

Sources

• @supabase/ssr createServerClient reference
• Supabase: creating a client for SSR

Related errors

• @supabase/auth-helpers-nextjs is deprecated: fix
• Supabase "Invalid Refresh Token: Refresh Token Not Found"
• Supabase "Invalid Refresh Token: Session Expired"
• Cookies can only be modified in a Server Action (Supabase)
• Supabase getSession() "could be insecure" warning

Full guide and free terminal scanner: Supabase auth-helpers → @supabase/ssr. Last checked 2026-10-31.