Skip to content

fix(auth): clear local session on signout failures#2503

Closed
pjpjq wants to merge 1 commit into
supabase:masterfrom
pjpjq:codex/clear-session-on-offline-signout
Closed

fix(auth): clear local session on signout failures#2503
pjpjq wants to merge 1 commit into
supabase:masterfrom
pjpjq:codex/clear-session-on-offline-signout

Conversation

@pjpjq

@pjpjq pjpjq commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Description

Fixes #2501.

signOut() previously returned immediately when the remote logout request produced a retryable/network auth error. For global and local sign-out scopes that meant the persisted browser/device session remained in storage, so an offline sign-out could reject while leaving the user locally authenticated.

This PR keeps the existing others semantics, but ensures global and local scopes always clear the current local session before returning the remote logout error.

Testing

  • pnpm install --frozen-lockfile
  • pnpm --dir packages/core/auth-js exec jest --config jest.config.js test/GoTrueClient.signOut.test.ts --runInBand --silent=false
  • pnpm nx build auth-js
  • pnpm prettier --check packages/core/auth-js/src/GoTrueClient.ts packages/core/auth-js/test/GoTrueClient.signOut.test.ts
  • pnpm exec eslint packages/core/auth-js/test/GoTrueClient.signOut.test.ts
  • git diff --check

Note: pnpm exec eslint packages/core/auth-js/src/GoTrueClient.ts ... is currently blocked by pre-existing lint errors in GoTrueClient.ts (unused variables / no-empty-object-type outside this diff), so I linted the new test file directly and relied on pnpm nx build auth-js for the changed source file.

@pjpjq
pjpjq requested review from a team as code owners July 7, 2026 04:29
@pjpjq pjpjq closed this Jul 7, 2026
@pjpjq
pjpjq deleted the codex/clear-session-on-offline-signout branch July 7, 2026 04:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

auth-js: signOut() throws before clearing local session when offline (all scopes, including 'local')

1 participant