Session management in Supabase - Step-by-Step Execution

Process Flow - Session management

User logs in

↓

Supabase creates session

↓

Session stored in client

↓

User makes requests

↓

Session token sent with requests

↓

Supabase verifies session

↓

Access granted or denied

↓

User logs out or session expires

↓

Session cleared

This flow shows how a user logs in, gets a session from Supabase, uses it for requests, and how the session ends.

Execution Sample

Supabase

const { data, error } = await supabase.auth.signInWithPassword({
  email: '[e-mail]',
  password: 'password123'
});

const session = data.session;
console.log(session);

This code logs in a user with email and password, then stores the session returned by Supabase.

Process Table

Step	Action	Input	Supabase Response	Client State
1	User calls signInWithPassword	{email: '[e-mail]', password: 'password123'}	Success with session token	Session stored in 'session' variable
2	Client stores session	Session token	N/A	Session saved locally for requests
3	User makes authenticated request	Request with session token	Verified session, access granted	Session remains valid
4	User logs out	Logout call	Session revoked	Session cleared from client
5	User makes request after logout	Request without session	Access denied	No session present

💡 Session ends when user logs out or session expires, stopping authenticated access.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 4	Final
session	null	session token object	session token object	null	null

Key Moments - 3 Insights

Why does the session variable become null after logout?

Because the logout call revokes the session on Supabase and clears it locally, as shown in execution_table step 4.

What happens if a request is made without a session token?

Supabase denies access since no valid session token is sent, as shown in execution_table step 5.

How is the session token used during requests?

The session token is sent with each request to verify the user’s identity, shown in execution_table step 3.

Visual Quiz - 3 Questions

Look at the execution table, what is the client state after step 2?

A Session saved locally for requests

B Session cleared from client

C No session present

D Session revoked

💡 Hint

Check the 'Client State' column in row for step 2 in execution_table.

At which step does the session variable become null?

A Step 1

B Step 2

C Step 4

D Step 3

💡 Hint

Look at variable_tracker for 'session' variable changes after each step.

If the user tries to make a request after logout, what will Supabase respond?

A Access granted

B Access denied

C Session renewed

D Request ignored

💡 Hint

See execution_table step 5 for Supabase response after logout.

Concept Snapshot

Session management with Supabase:
- User logs in with signInWithPassword
- Supabase returns a session token
- Client stores session for authenticated requests
- Session token sent with each request
- Logout clears session and revokes access

Full Transcript

Session management in Supabase starts when a user logs in using their email and password. Supabase returns a session token that the client stores locally. This token is sent with every request to prove the user's identity. Supabase checks the token and grants or denies access accordingly. When the user logs out, the session token is revoked and cleared from the client, stopping further access. If a request is made without a valid session, access is denied.

Practice

1. What does session management in Supabase primarily help you do?

easy

A. Keep track of who is logged in

B. Store database tables

C. Manage server resources

D. Create new users automatically

Solution

1. Step 1: Understand session management purpose

   Session management is about tracking user login status.

2. Step 2: Match with Supabase context

   Supabase uses sessions to know who is logged in or out.

3. Final Answer:

   Keep track of who is logged in -> Option A

4. Quick Check:

   Session management = tracking logged-in users [OK]

Hint: Sessions track logged-in users, not data or servers [OK]

Common Mistakes:

• Confusing session with database storage
• Thinking session manages server resources
• Assuming session creates users automatically

2. Which Supabase method is used to log a user in with email and password?

easy

A. signOut

B. getSession

C. signInWithPassword

D. createUser

Solution

1. Step 1: Identify login method

   Supabase uses signInWithPassword to log users in with email and password.

2. Step 2: Eliminate other options

   signOut logs out, getSession checks session, createUser is not a Supabase method.

3. Final Answer:

   signInWithPassword -> Option C

4. Quick Check:

   Login method = signInWithPassword [OK]

Hint: Login uses signInWithPassword, logout uses signOut [OK]

Common Mistakes:

• Choosing signOut to log in
• Confusing getSession with login
• Assuming createUser is a Supabase method

3. What will the following code return if a user is logged in?

const { data } = await supabase.auth.getSession();
console.log(data.session);

medium

A. An object with session details

B. null

C. An error message

D. Undefined

Solution

1. Step 1: Understand getSession behavior

   getSession returns session info if user is logged in.

2. Step 2: Analyze console output

   Logging data.session shows session object, not null or error.

3. Final Answer:

   An object with session details -> Option A

4. Quick Check:

   Logged-in session = session object [OK]

Hint: getSession returns session object if logged in, else null [OK]

Common Mistakes:

• Expecting null when user is logged in
• Thinking getSession throws error
• Assuming undefined is returned

4. You wrote this code to log out a user:

await supabase.auth.signInWithPassword();

What is wrong here?

medium

A. You need to pass email and password to signInWithPassword

B. signInWithPassword is for logging in, not logging out

C. signInWithPassword does not exist in Supabase

D. You should use getSession to log out

Solution

1. Step 1: Identify method purpose

   signInWithPassword is for logging in users, not logging out.

2. Step 2: Correct logout method

   To log out, use signOut method instead.

3. Final Answer:

   signInWithPassword is for logging in, not logging out -> Option B

4. Quick Check:

   Logout method ≠ signInWithPassword [OK]

Hint: Use signOut to log out, not signInWithPassword [OK]

Common Mistakes:

• Using signInWithPassword to log out
• Forgetting to pass credentials to signInWithPassword
• Confusing getSession with logout

5. You want to check if a user is logged in before showing a dashboard. Which code snippet correctly does this using Supabase session management?

hard

A. const session = await supabase.auth.signInWithPassword(); if (session) { showDashboard(); } else { showLogin(); }

B. const session = supabase.auth.signOut(); if (session) { showDashboard(); } else { showLogin(); }

C. const session = supabase.auth.getUser(); if (session) { showDashboard(); } else { showLogin(); }

D. const { data } = await supabase.auth.getSession(); if (data.session) { showDashboard(); } else { showLogin(); }

Solution

1. Step 1: Identify correct session check method

   getSession returns current session info to check login status.

2. Step 2: Verify conditional logic

   If data.session exists, user is logged in; else show login screen.

3. Step 3: Eliminate incorrect options

   signInWithPassword logs users in, signOut logs users out, getUser requires await and checking data.user (e.g. const { data } = await supabase.auth.getUser(); if (data.user)) but const session = supabase.auth.getUser(); if (session) { showDashboard(); } else { showLogin(); } lacks both.

4. Final Answer:

   const { data } = await supabase.auth.getSession(); if (data.session) { showDashboard(); } else { showLogin(); } -> Option D

5. Quick Check:

   Check session with getSession before showing dashboard [OK]

Hint: Use getSession and check data.session to confirm login [OK]

Common Mistakes:

• Using signOut or signInWithPassword to check session
• Using getUser without await and proper data.user check
• Not checking if session is null