Two things I ran into while testing with a SessionHandler set up.
First, InitializeAsync() doesn't restore anything. The readme for the Supabase package says it restores and refreshes a persisted session, but it only calls Auth.RetrieveSessionAsync(), which returns early when CurrentSession is null, and nothing in the umbrella client ever calls LoadSession(). So SaveSession and DestroySession get called but LoadSession never does, and after a restart every request goes out with the anon key. Calling supabase.Auth.LoadSession() before InitializeAsync() works around it, same as the gotrue readme shows.
Second, once a session is restored a failed refresh deletes it. The catch in packages/Gotrue/Gotrue/Client.cs treats every exception the same, so a connection error looks identical to gotrue rejecting the refresh token, and it hits DestroySession() on line 669. Starting the app offline with AutoRefreshToken = true goes:
LoadSession() restores the saved sessionInitializeAsync() → RetrieveSessionAsync() → refresh throws a connection error- the catch calls
DestroySession(), the persistence listener fires, session gets wiped from disk
The user stays signed out even once they're back online. Repros against any dead host, point the client at an unused port.
These are linked. Fixing the first on its own would make the second hit everyone by default instead of only the people calling LoadSession themselves.
I can work on this.
Two things I ran into while testing with a
SessionHandlerset up.First,
InitializeAsync()doesn't restore anything. The readme for the Supabase package says it restores and refreshes a persisted session, but it only callsAuth.RetrieveSessionAsync(), which returns early whenCurrentSessionis null, and nothing in the umbrella client ever callsLoadSession(). SoSaveSessionandDestroySessionget called butLoadSessionnever does, and after a restart every request goes out with the anon key. Callingsupabase.Auth.LoadSession()beforeInitializeAsync()works around it, same as the gotrue readme shows.Second, once a session is restored a failed refresh deletes it. The catch in
packages/Gotrue/Gotrue/Client.cstreats every exception the same, so a connection error looks identical to gotrue rejecting the refresh token, and it hitsDestroySession()on line 669. Starting the app offline withAutoRefreshToken = truegoes:LoadSession()restores the saved sessionInitializeAsync()→RetrieveSessionAsync()→ refresh throws a connection errorDestroySession(), the persistence listener fires, session gets wiped from diskThe user stays signed out even once they're back online. Repros against any dead host, point the client at an unused port.
These are linked. Fixing the first on its own would make the second hit everyone by default instead of only the people calling
LoadSessionthemselves.I can work on this.