---
title: "Users get logged out when they refresh the page"
description: "In Next.js apps the server cannot see a browser-only Supabase session, and expired tokens are never refreshed. How to check the auth setup and fix it."
url: https://whocanfixmyapp.com/problems/users-get-logged-out-on-refresh
---

[Home](https://whocanfixmyapp.com/) / [Problems](https://whocanfixmyapp.com/problems) / [Sign-in and accounts](https://whocanfixmyapp.com/problems#sign-in-and-accounts)

# Users get logged out when they refresh the page

VC-26 · Supabase · Next.js · v0 · Updated October 2026 · By [Nathaniel Kelley](https://whocanfixmyapp.com/authors/nathaniel-kelley)

Quick verdict

Get an engineer for this one. Needs code changes in the auth setup files.

- **How serious**: Medium
- **Fix it yourself?**: No, get an engineer
- **Typical cost**: €99–$990 for a single fix ([prices](https://whocanfixmyapp.com/pricing))
- **Top rated for Supabase**: [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10

**What you see.** Users sign in fine, but pressing refresh or opening a new tab sends them straight back to the login page.

## Why it happens

A Supabase session is an access token that lives about one hour plus a refresh token that fetches a new one. In a plain browser app the client library keeps both and refreshes them. In a Next.js App Router app, which is what v0 generates, pages render on the server first. The server cannot see a session stored only in the browser, so it treats the visitor as signed out and redirects.

Supabase's answer is the `@supabase/ssr` package, which stores the session in cookies and uses a `proxy.ts` file (formerly `middleware.ts`) to refresh expired tokens on every request. Supabase notes that if that file never runs, sessions do not refresh and users get signed out. Agents often mix the browser client and the server client, or skip the proxy file, so the app works for an hour and then drops everyone. A related trap is trusting `getSession()` on the server. Supabase warns it reads the cookie without revalidating it.

## Fix it yourself

1. Sign in, then refresh. If you are logged out at once, the server cannot see the session. If it happens after about an hour, token refresh is missing.
2. Search the code for `createClient`. A Next.js app needs two versions from `@supabase/ssr`, a browser client and a server client.
3. Check for a `proxy.ts` or `middleware.ts` file at the project root that calls `supabase.auth.getClaims()` and copies the refreshed cookies onto the response.
4. Ask the agent to follow the Supabase Next.js server-side auth guide exactly, and to replace `getSession()` in server code with `getClaims()` or `getUser()`.
5. Redeploy and test in a private window, including a refresh after more than an hour.

## When to get an engineer

Stop here if you are not comfortable editing the auth files, because a mistake can lock everyone out or let a stale session through. Tell the engineer the Next.js version, whether the app uses the App Router, and when the logout happens, at once or after an hour. A single fix at €99–$990 usually covers it in 1–3 days. If sign-in was hand-built instead of using a library, budget for cleanup at $1,500–$15,000.

## Top-rated companies for Supabase apps

Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. [How we score](https://whocanfixmyapp.com/methodology#score).

- 1 · [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10 · Best for: A full rescue by one team that keeps building · Free first step · from $490
- 2 · [Vibe Code Rescue (Lev Arakelyan)](https://whocanfixmyapp.com/companies/vibe-code-rescue-lev-arakelyan) · **9.0**/10 · Best for: A one-off check and a cleanup · From $299
- 3 · [LazyCodeLab](https://whocanfixmyapp.com/companies/lazycodelab) · **9.0**/10 · Best for: A one-off check and a cleanup · From $399

[All 29 Supabase companies, ranked](https://whocanfixmyapp.com/best/supabase-developers)

## Check these

AUTH-02 · High

Signing out really ends the session

Sign out, press Back, and refresh. You should not see private pages or data.

AUTH-01 · High

Sign-up confirmation and password reset work end to end

Use a real inbox. Check that the link arrives, points to your live domain, and works once.

DATA-03 · Critical

One user cannot open another user's records

Sign in as user A, copy a request from the Network tab, and change the record ID to one that belongs to user B. You should get an error or an empty result.

## Questions

### Is this a Supabase outage?

Almost never. Supabase keeps the session on its side. The problem is that your app's server rendering cannot read or refresh the session stored in the browser.

### Why does it work for an hour and then stop?

Access tokens expire after one hour by default. Without the proxy file refreshing them in cookies, the expired token is all the server sees, so it treats the user as signed out.

Sources: [Supabase: Server-side auth for Next.js](https://supabase.com/docs/guides/auth/server-side/nextjs); [Supabase: User sessions](https://supabase.com/docs/guides/auth/sessions); [Next.js: Authentication guide](https://nextjs.org/docs/app/guides/authentication).

**Supabase guide**

What Supabase builds, where it breaks and how to check it: [Supabase RLS audit: how to check an AI-built app's database rules](https://whocanfixmyapp.com/guides/supabase).

**Same category**

- [Users can't log in on the live site](https://whocanfixmyapp.com/problems/users-cant-log-in-on-the-live-site)
- [Google sign-in fails with redirect_uri_mismatch](https://whocanfixmyapp.com/problems/google-sign-in-redirect-uri-mismatch)
- [Confirmation and password-reset emails never arrive](https://whocanfixmyapp.com/problems/confirmation-and-password-reset-emails-never-arrive)
- [Admin pages open to anyone with the link](https://whocanfixmyapp.com/problems/admin-pages-open-to-anyone-with-the-link)
- [Users can see each other's data](https://whocanfixmyapp.com/problems/users-can-see-each-others-data)
- [Supabase says "new row violates row-level security policy"](https://whocanfixmyapp.com/problems/supabase-rls-blocking-insert)

[All sign-in and accounts problems](https://whocanfixmyapp.com/problems#sign-in-and-accounts)

**Run every check**

The [production checklist](https://whocanfixmyapp.com/checklist) has all 24 checks with a verdict.