What is Session?

The app's memory that you are signed in, kept for a while so you don't log in on every page.

Where Session goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

The life of a click · 4 minutes · Pro
Logged out after an hour
Users fill in a long form, press Save, and get 'Unauthorized'. It always happens about an hour after they signed in.
Why do my users get logged out after an hour?
Access tokens are short-lived, often about an hour, and must be renewed with a refresh token. If nothing refreshes the session before requests, especially on server-rendered pages that cannot set cookies, users see 'Unauthorized'. Refresh the session in code that runs before each request.
Read the fix
Bills that explode · 5 minutes · Pro
The address box that cost $1,900
Your checkout suggests addresses as people type, using a maps API. Orders are steady, but this month's maps bill is $1,900.
How do I reduce my Google Maps API bill?
Count what triggers each call. Address autocomplete often sends a billable request on every keystroke. Wait for a short pause and a few characters, use session tokens so searches can be billed together when a place is chosen, restrict your key to your site and the APIs you use, set daily quotas, and cache only what the provider's terms allow.
Read the fix
Accounts and privacy · 4 minutes · Pro
The immortal reset link
A customer forwarded an old 'reset your password' email to a colleague by mistake. Months later, that link still lets anyone set a new password.
How long should a password reset link last?
A reset link should expire after a short time, often 15 to 60 minutes, work only once, and be cancelled when a newer link is requested. After the password changes, sign out other sessions and email the owner. Tokens must be long and random. A link that never expires turns every old email into a working key.
Read the fix
Teams and sharing · 4 minutes · Pro
The export with everyone's data
A customer clicked 'Export orders to CSV'. The file had 40,000 rows. Their team has 300 orders. The rest belong to your other customers.
Does the Supabase service role bypass RLS?
Yes. The service role key bypasses every row level security policy by design, so any server code using it must check permissions itself. Leaks happen when that code also takes the team or user id from the URL or request body. Query with the signed-in user's client so RLS applies, and derive the team from their session.
Read the fix
Getting paid · 4 minutes · Free
The success page anyone could visit
Your app has 41 Pro accounts. Stripe shows 29 paying customers. Nobody hacked anything: twelve people just typed an address.
Should I grant access on the Stripe success page?
No. The success page is just where the browser lands after checkout, and anyone can type its address, so granting access there gives your paid plan away. Grant access in your webhook when Stripe sends checkout.session.completed, verified by its signature. Let the success page only read and display the plan your database already holds.
Walk it, free
Who may see what · 4 minutes · Pro
The admin button
Only admins see the Refund button. A regular user has just refunded their own last three orders.
Is hiding the admin button enough?
No. Hiding a button only changes what is shown. Anyone can send the same request without the button. Every sensitive endpoint must check the caller's role on the server, reading that role from your database or a verified session, never from the request body.
Read the fix

Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
Browser: Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.
Database: Where your app keeps its data, organised in tables, like a set of spreadsheets.
Server: A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
Secret key: A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.
Token: A temporary pass that proves who you are. Access tokens expire quickly; a refresh token quietly gets a new one.

All 62 terms in the glossary

Where Session goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

The life of a click · 4 minutes · Pro

Logged out after an hour

Users fill in a long form, press Save, and get 'Unauthorized'. It always happens about an hour after they signed in.

Why do my users get logged out after an hour?

Access tokens are short-lived, often about an hour, and must be renewed with a refresh token. If nothing refreshes the session before requests, especially on server-rendered pages that cannot set cookies, users see 'Unauthorized'. Refresh the session in code that runs before each request.

Read the fix

Bills that explode · 5 minutes · Pro

The address box that cost $1,900

Your checkout suggests addresses as people type, using a maps API. Orders are steady, but this month's maps bill is $1,900.

How do I reduce my Google Maps API bill?

Count what triggers each call. Address autocomplete often sends a billable request on every keystroke. Wait for a short pause and a few characters, use session tokens so searches can be billed together when a place is chosen, restrict your key to your site and the APIs you use, set daily quotas, and cache only what the provider's terms allow.

Read the fix

Accounts and privacy · 4 minutes · Pro

The immortal reset link

A customer forwarded an old 'reset your password' email to a colleague by mistake. Months later, that link still lets anyone set a new password.

How long should a password reset link last?

A reset link should expire after a short time, often 15 to 60 minutes, work only once, and be cancelled when a newer link is requested. After the password changes, sign out other sessions and email the owner. Tokens must be long and random. A link that never expires turns every old email into a working key.

Read the fix

Teams and sharing · 4 minutes · Pro

The export with everyone's data

A customer clicked 'Export orders to CSV'. The file had 40,000 rows. Their team has 300 orders. The rest belong to your other customers.

Does the Supabase service role bypass RLS?

Yes. The service role key bypasses every row level security policy by design, so any server code using it must check permissions itself. Leaks happen when that code also takes the team or user id from the URL or request body. Query with the signed-in user's client so RLS applies, and derive the team from their session.

Read the fix

Getting paid · 4 minutes · Free

The success page anyone could visit

Your app has 41 Pro accounts. Stripe shows 29 paying customers. Nobody hacked anything: twelve people just typed an address.

Should I grant access on the Stripe success page?

No. The success page is just where the browser lands after checkout, and anyone can type its address, so granting access there gives your paid plan away. Grant access in your webhook when Stripe sends checkout.session.completed, verified by its signature. Let the success page only read and display the plan your database already holds.

Walk it, free

Who may see what · 4 minutes · Pro

The admin button

Only admins see the Refund button. A regular user has just refunded their own last three orders.

Is hiding the admin button enough?

No. Hiding a button only changes what is shown. Anyone can send the same request without the button. Every sensitive endpoint must check the caller's role on the server, reading that role from your database or a verified session, never from the request body.

Read the fix

Related terms

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

Browser

Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.

Database

Where your app keeps its data, organised in tables, like a set of spreadsheets.

Server

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

Secret key

A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.

Token

A temporary pass that proves who you are. Access tokens expire quickly; a refresh token quietly gets a new one.