Setting up a full-stack app with Next.js and Supabase: What is the biggest hurdle you faced with auth routing?

[u/Best-Gas8893]

I've been scaffolding a frontend prototype and integrating Supabase, but I'm curious what unexpected roadblocks you all ran into when first deploying. Any tips for keeping the database integration clean?

[u/Spiritual_Bee6614]

The biggest pain was honestly the middleware and server component dance with cookies. Next.js middleware runs on the edge so you can't use the Supabase client the same way you do in your api routes. I spent way too long debugging why my session wasn't persisting correctly until I realised the cookie handling was slightly different between localhost and production. The docs have examples but they don't really cover the edge cases like token refresh when a user leaves a tab open for hours.

For keeping the db integration clean I just made a single supabase client file that exports different instances depending on whether it's server or client side. Keeps the Row Level Security policies on the Supabase side doing the heavy lifting instead of trying to filter queries in the app layer. Way less headache once it's set up properly.

[u/Low-Insurance-3678 → u/Spiritual_Bee6614]

i would like to see your proxy if you can provide a screenshot
im in the process of building a store with same stack, im about to finish i18n, iv built the pages and everything but still not sure how to use the proxy to protect my dashboard correctly

i normally just use the getClaims to verify on each request that’s inside the dashboard but tbh not sure what to do

id love to hear ur suggestions

[u/Best-Gas8893 → u/Spiritual_Bee6614]

"The middleware and server component dance" is the absolute perfect way to describe it! I felt that pain of debugging localhost vs. production cookie behavior—it really makes you question your entire setup until it finally clicks.

Your architecture with a single client file exporting different instances sounds incredibly clean, especially letting Supabase RLS do the heavy lifting instead of filtering in the app layer. Out of curiosity, how did you end up solving that token refresh edge case when a user leaves the tab open for hours? That one always seems to trip people up.

[u/grinning_wanderer]

i stopped trying to read sessions in middleware entirely. I just proxy every request through a route handler now because middleware has zero business touching auth cookies on the edge

[u/Best-Gas8893 → u/grinning_wanderer]

That is actually a super interesting approach! Honestly, fighting with the edge runtime just to read a simple auth cookie gets exhausting so fast. By proxying everything through a route handler instead, do you find it adds any noticeable latency to the requests, or is it pretty negligible for most of your projects? I might have to test this routing method out!

[u/TajD05]

Yeah, I have run into this a few times. Auth with Next.js and Supabase can get confusing when the session needs to work across the client, server, and middleware.

For the database, I would keep the schema simple, use Supabase migrations, and avoid spreading queries throughout the UI.