Skip to content

fix(auth): downgrade aborted/transient fetch failures from console.error to warn#2544

Merged
mandarini merged 2 commits into
masterfrom
fix/auth-transient-fetch-console-noise
Jul 21, 2026
Merged

fix(auth): downgrade aborted/transient fetch failures from console.error to warn#2544
mandarini merged 2 commits into
masterfrom
fix/auth-transient-fetch-console-noise

Conversation

@mandarini

@mandarini mandarini commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

When a page load starts GoTrueClient session recovery and the user navigates away before it settles, the browser aborts the in-flight auth request. The rejection (TypeError: Failed to fetch) was logged raw via console.error, polluting production consoles and breaking strict zero-console-error E2E gates, even though nothing is actually wrong (the page was simply superseded).

These failures are already modeled as AuthRetryableFetchError and treated as transient elsewhere in auth-js. This PR brings the logging in line: it removes the unconditional raw console.error in the fetch helper (_handleRequest) and downgrades retryable fetch failures to console.warn in the INITIAL_SESSION emission and _recoverAndRefresh, using the existing isAuthRetryableFetchError discriminator. Genuine non-retryable errors still log at console.error. This is a log-level change only, with no behavior or API change, and adds tests covering all three paths.

Note for reviewers: removing the fetch-helper log affects all failed fetches (not just aborts), so a genuine CORS/network failure during e.g. signInWithPassword no longer logs at the fetch layer; it still surfaces to the caller via the returned error.

Closes #2543

@coderabbitai

coderabbitai Bot commented Jul 21, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a22f3594-0d1e-4137-a3e0-95dd05e10e75

📥 Commits

Reviewing files that changed from the base of the PR and between aafcf0a and 5fe53e5.

📒 Files selected for processing (4)
  • packages/core/auth-js/src/GoTrueClient.ts
  • packages/core/auth-js/src/lib/fetch.ts
  • packages/core/auth-js/test/GoTrueClient.test.ts
  • packages/core/auth-js/test/fetch.test.ts
🚧 Files skipped from review as they are similar to previous changes (3)
  • packages/core/auth-js/src/lib/fetch.ts
  • packages/core/auth-js/test/GoTrueClient.test.ts
  • packages/core/auth-js/src/GoTrueClient.ts

📝 Walkthrough

Summary by CodeRabbit

  • Bug Fixes
    • Reduced console noise during temporary network, CORS, aborted, and retryable session-recovery failures by switching retryable logging from errors to warnings.
    • Fetch failures that are retryable now surface consistently as retryable errors without logging via console.error.
    • Non-retryable authentication issues continue to be reported as errors.
  • Tests
    • Added coverage to verify console logging behavior for retryable vs non-retryable transient failures.

Walkthrough

Auth fetch failures remain retryable without raw logging. During initial session emission and session recovery, retryable fetch/network failures use console.warn, while non-retryable failures continue using console.error. Tests cover both recovery paths, genuine errors, and aborted fetch requests without console errors.

Sequence Diagram(s)

sequenceDiagram
  participant Fetch
  participant GoTrueClient
  participant Console
  Fetch->>GoTrueClient: Throw AuthRetryableFetchError
  GoTrueClient->>Console: Log retryable failure with console.warn
  GoTrueClient->>GoTrueClient: Leave session unchanged for later recovery
Loading

Assessment against linked issues

Objective Addressed Explanation
Prevent aborted or transient session-recovery failures from producing raw console.error output [#2543]

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot added the auth-js Related to the auth-js library. label Jul 21, 2026
@pkg-pr-new

pkg-pr-new Bot commented Jul 21, 2026

Copy link
Copy Markdown

Open in StackBlitz

@supabase/auth-js

npm i https://pkg.pr.new/@supabase/auth-js@2544

@supabase/functions-js

npm i https://pkg.pr.new/@supabase/functions-js@2544

@supabase/postgrest-js

npm i https://pkg.pr.new/@supabase/postgrest-js@2544

@supabase/realtime-js

npm i https://pkg.pr.new/@supabase/realtime-js@2544

@supabase/storage-js

npm i https://pkg.pr.new/@supabase/storage-js@2544

@supabase/supabase-js

npm i https://pkg.pr.new/@supabase/supabase-js@2544

commit: 5fe53e5

@mandarini
mandarini marked this pull request as ready for review July 21, 2026 12:45
@mandarini
mandarini requested review from a team as code owners July 21, 2026 12:45
@github-actions

Copy link
Copy Markdown
Contributor

⚠️ Capability matrix drift detected

The following capabilities are marked implemented in javascript but have no registered symbols to verify:

  • auth.admin.create_provider (no symbols list — cannot confirm implementation exists)
  • auth.admin.create_user (no symbols list — cannot confirm implementation exists)
  • auth.admin.delete_mfa_factor (no symbols list — cannot confirm implementation exists)
  • auth.admin.delete_provider (no symbols list — cannot confirm implementation exists)
  • auth.admin.delete_user (no symbols list — cannot confirm implementation exists)
  • auth.admin.generate_link (no symbols list — cannot confirm implementation exists)
  • auth.admin.get_provider (no symbols list — cannot confirm implementation exists)
  • auth.admin.get_user (no symbols list — cannot confirm implementation exists)
  • auth.admin.invite_user (no symbols list — cannot confirm implementation exists)
  • auth.admin.list_mfa_factors (no symbols list — cannot confirm implementation exists)
  • auth.admin.list_providers (no symbols list — cannot confirm implementation exists)
  • auth.admin.list_users (no symbols list — cannot confirm implementation exists)
  • auth.admin.sign_out (no symbols list — cannot confirm implementation exists)
  • auth.admin.update_provider (no symbols list — cannot confirm implementation exists)
  • auth.admin.update_user (no symbols list — cannot confirm implementation exists)
  • auth.identities.link_identity (no symbols list — cannot confirm implementation exists)
  • auth.identities.list_identities (no symbols list — cannot confirm implementation exists)
  • auth.identities.unlink_identity (no symbols list — cannot confirm implementation exists)
  • auth.mfa.challenge (no symbols list — cannot confirm implementation exists)
  • auth.mfa.challenge_and_verify (no symbols list — cannot confirm implementation exists)
  • auth.mfa.enroll (no symbols list — cannot confirm implementation exists)
  • auth.mfa.get_authenticator_assurance_level (no symbols list — cannot confirm implementation exists)
  • auth.mfa.list_factors (no symbols list — cannot confirm implementation exists)
  • auth.mfa.unenroll (no symbols list — cannot confirm implementation exists)
  • auth.mfa.verify (no symbols list — cannot confirm implementation exists)
  • auth.oauth_admin.create_client (no symbols list — cannot confirm implementation exists)
  • auth.oauth_admin.delete_client (no symbols list — cannot confirm implementation exists)
  • auth.oauth_admin.get_client (no symbols list — cannot confirm implementation exists)
  • auth.oauth_admin.list_clients (no symbols list — cannot confirm implementation exists)
  • auth.oauth_admin.regenerate_client_secret (no symbols list — cannot confirm implementation exists)
  • auth.oauth_admin.update_client (no symbols list — cannot confirm implementation exists)
  • auth.oauth_server.approve_authorization (no symbols list — cannot confirm implementation exists)
  • auth.oauth_server.deny_authorization (no symbols list — cannot confirm implementation exists)
  • auth.oauth_server.get_authorization_details (no symbols list — cannot confirm implementation exists)
  • auth.oauth_server.list_grants (no symbols list — cannot confirm implementation exists)
  • auth.oauth_server.revoke_grant (no symbols list — cannot confirm implementation exists)
  • auth.passkey.register_passkey (no symbols list — cannot confirm implementation exists)
  • auth.passkey.sign_in_with_passkey (no symbols list — cannot confirm implementation exists)
  • auth.passkey_admin.delete_passkey (no symbols list — cannot confirm implementation exists)
  • auth.passkey_admin.list_passkeys (no symbols list — cannot confirm implementation exists)
  • auth.session.auto_refresh (no symbols list — cannot confirm implementation exists)
  • auth.session.get_claims (no symbols list — cannot confirm implementation exists)
  • auth.session.get_session (no symbols list — cannot confirm implementation exists)
  • auth.session.get_user (no symbols list — cannot confirm implementation exists)
  • auth.session.refresh_session (no symbols list — cannot confirm implementation exists)
  • auth.session.set_session (no symbols list — cannot confirm implementation exists)
  • auth.session.sign_out (no symbols list — cannot confirm implementation exists)
  • auth.session.subscribe_auth_events (no symbols list — cannot confirm implementation exists)
  • auth.session.update_user (no symbols list — cannot confirm implementation exists)
  • auth.sign_in.exchange_code_for_session (no symbols list — cannot confirm implementation exists)
  • auth.sign_in.reauthenticate (no symbols list — cannot confirm implementation exists)
  • auth.sign_in.resend_confirmation (no symbols list — cannot confirm implementation exists)
  • auth.sign_in.reset_password (no symbols list — cannot confirm implementation exists)
  • auth.sign_in.sign_in_anonymously (no symbols list — cannot confirm implementation exists)
  • auth.sign_in.sign_in_with_id_token (no symbols list — cannot confirm implementation exists)
  • auth.sign_in.sign_in_with_oauth (no symbols list — cannot confirm implementation exists)
  • auth.sign_in.sign_in_with_otp (no symbols list — cannot confirm implementation exists)
  • auth.sign_in.sign_in_with_password (no symbols list — cannot confirm implementation exists)
  • auth.sign_in.sign_in_with_sso (no symbols list — cannot confirm implementation exists)
  • auth.sign_in.sign_in_with_web3 (no symbols list — cannot confirm implementation exists)
  • auth.sign_in.sign_up (no symbols list — cannot confirm implementation exists)
  • auth.sign_in.verify_otp (no symbols list — cannot confirm implementation exists)
  • database.mutate.delete (no symbols list — cannot confirm implementation exists)
  • database.mutate.insert (no symbols list — cannot confirm implementation exists)
  • database.mutate.update (no symbols list — cannot confirm implementation exists)
  • database.mutate.upsert (no symbols list — cannot confirm implementation exists)
  • database.query.from_table (no symbols list — cannot confirm implementation exists)
  • database.query.rpc (no symbols list — cannot confirm implementation exists)
  • database.query.schema_selection (no symbols list — cannot confirm implementation exists)
  • database.query.select (no symbols list — cannot confirm implementation exists)
  • database.using_filters.contained_by (no symbols list — cannot confirm implementation exists)
  • database.using_filters.contains (no symbols list — cannot confirm implementation exists)
  • database.using_filters.eq (no symbols list — cannot confirm implementation exists)
  • database.using_filters.gt (no symbols list — cannot confirm implementation exists)
  • database.using_filters.gte (no symbols list — cannot confirm implementation exists)
  • database.using_filters.ilike (no symbols list — cannot confirm implementation exists)
  • database.using_filters.ilike_all (no symbols list — cannot confirm implementation exists)
  • database.using_filters.ilike_any (no symbols list — cannot confirm implementation exists)
  • database.using_filters.in (no symbols list — cannot confirm implementation exists)
  • database.using_filters.is (no symbols list — cannot confirm implementation exists)
  • database.using_filters.is_distinct (no symbols list — cannot confirm implementation exists)
  • database.using_filters.like (no symbols list — cannot confirm implementation exists)
  • database.using_filters.like_all (no symbols list — cannot confirm implementation exists)
  • database.using_filters.like_any (no symbols list — cannot confirm implementation exists)
  • database.using_filters.lt (no symbols list — cannot confirm implementation exists)
  • database.using_filters.lte (no symbols list — cannot confirm implementation exists)
  • database.using_filters.match (no symbols list — cannot confirm implementation exists)
  • database.using_filters.neq (no symbols list — cannot confirm implementation exists)
  • database.using_filters.not (no symbols list — cannot confirm implementation exists)
  • database.using_filters.not_in (no symbols list — cannot confirm implementation exists)
  • database.using_filters.or (no symbols list — cannot confirm implementation exists)
  • database.using_filters.overlaps (no symbols list — cannot confirm implementation exists)
  • database.using_filters.range_adjacent (no symbols list — cannot confirm implementation exists)
  • database.using_filters.range_gt (no symbols list — cannot confirm implementation exists)
  • database.using_filters.range_gte (no symbols list — cannot confirm implementation exists)
  • database.using_filters.range_lt (no symbols list — cannot confirm implementation exists)
  • database.using_filters.range_lte (no symbols list — cannot confirm implementation exists)
  • database.using_filters.raw (no symbols list — cannot confirm implementation exists)
  • database.using_filters.regex (no symbols list — cannot confirm implementation exists)
  • database.using_filters.regex_icase (no symbols list — cannot confirm implementation exists)
  • database.using_filters.text_search (no symbols list — cannot confirm implementation exists)
  • database.using_modifiers.dry_run (no symbols list — cannot confirm implementation exists)
  • database.using_modifiers.explain (no symbols list — cannot confirm implementation exists)
  • database.using_modifiers.format_csv (no symbols list — cannot confirm implementation exists)
  • database.using_modifiers.format_geojson (no symbols list — cannot confirm implementation exists)
  • database.using_modifiers.limit (no symbols list — cannot confirm implementation exists)
  • database.using_modifiers.max_affected_rows (no symbols list — cannot confirm implementation exists)
  • database.using_modifiers.maybe_single_row (no symbols list — cannot confirm implementation exists)
  • database.using_modifiers.order (no symbols list — cannot confirm implementation exists)
  • database.using_modifiers.range (no symbols list — cannot confirm implementation exists)
  • database.using_modifiers.single_row (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.access_bucket (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.copy (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.create_file_bucket (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.create_signed_upload_url (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.create_signed_url (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.create_signed_urls (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.delete_file_bucket (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.download (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.empty_bucket (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.file_exists (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.file_info (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.get_bucket (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.get_public_url (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.list_file_buckets (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.list_files (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.list_files_paginated (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.move (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.remove (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.update_bucket (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.update_file (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.upload (no symbols list — cannot confirm implementation exists)
  • storage.file_buckets.upload_with_signed_url (no symbols list — cannot confirm implementation exists)
  • storage.vector_buckets.access_vector_index (no symbols list — cannot confirm implementation exists)
  • storage.vector_buckets.create_index (no symbols list — cannot confirm implementation exists)
  • storage.vector_buckets.delete_index (no symbols list — cannot confirm implementation exists)
  • storage.vector_buckets.delete_vectors (no symbols list — cannot confirm implementation exists)
  • storage.vector_buckets.get_index (no symbols list — cannot confirm implementation exists)
  • storage.vector_buckets.get_vectors (no symbols list — cannot confirm implementation exists)
  • storage.vector_buckets.list_indexes (no symbols list — cannot confirm implementation exists)
  • storage.vector_buckets.list_vectors (no symbols list — cannot confirm implementation exists)
  • storage.vector_buckets.put_vectors (no symbols list — cannot confirm implementation exists)
  • storage.vector_buckets.query_vectors (no symbols list — cannot confirm implementation exists)
  • realtime.channel.broadcast_http (no symbols list — cannot confirm implementation exists)
  • realtime.channel.send (no symbols list — cannot confirm implementation exists)
  • realtime.channel.subscribe (no symbols list — cannot confirm implementation exists)
  • realtime.channel.unsubscribe (no symbols list — cannot confirm implementation exists)
  • realtime.client.channel (no symbols list — cannot confirm implementation exists)
  • realtime.client.connect (no symbols list — cannot confirm implementation exists)
  • realtime.client.connection_state (no symbols list — cannot confirm implementation exists)
  • realtime.client.disconnect (no symbols list — cannot confirm implementation exists)
  • realtime.client.get_channels (no symbols list — cannot confirm implementation exists)
  • realtime.client.listen_heartbeats (no symbols list — cannot confirm implementation exists)
  • realtime.client.remove_all_channels (no symbols list — cannot confirm implementation exists)
  • realtime.client.remove_channel (no symbols list — cannot confirm implementation exists)
  • realtime.client.set_auth_token (no symbols list — cannot confirm implementation exists)
  • realtime.presence.presence_state (no symbols list — cannot confirm implementation exists)
  • realtime.presence.track (no symbols list — cannot confirm implementation exists)
  • realtime.presence.untrack (no symbols list — cannot confirm implementation exists)
  • realtime.subscriptions.broadcast (no symbols list — cannot confirm implementation exists)
  • realtime.subscriptions.subscribe_presence (no symbols list — cannot confirm implementation exists)
  • functions.invocation.invoke (no symbols list — cannot confirm implementation exists)
  • functions.invocation.set_auth_token (no symbols list — cannot confirm implementation exists)

These may have been renamed, removed, or never registered. Please update the capability matrix.
See: https://github.com/supabase/sdk/blob/main/docs/capability-matrix.md

@coveralls

coveralls commented Jul 21, 2026

Copy link
Copy Markdown

Coverage Status

coverage: 80.673% (+0.04%) from 80.631% — fix/auth-transient-fetch-console-noise into master

@mandarini
mandarini force-pushed the fix/auth-transient-fetch-console-noise branch from aafcf0a to 5fe53e5 Compare July 21, 2026 13:05
@mandarini mandarini self-assigned this Jul 21, 2026
@mandarini
mandarini merged commit b0d121e into master Jul 21, 2026
30 of 31 checks passed
@mandarini
mandarini deleted the fix/auth-transient-fetch-console-noise branch July 21, 2026 13:37
mandarini pushed a commit to supabase/supabase that referenced this pull request Jul 22, 2026
This PR updates @supabase/*-js libraries to version 2.110.8.

**Source**: supabase-js-stable-release

**Changes**:
- Updated @supabase/supabase-js to 2.110.8
- Updated @supabase/auth-js to 2.110.8
- Updated @supabase/realtime-js to 2.110.8
- Updated @supabase/postgest-js to 2.110.8
- Refreshed pnpm-lock.yaml

---

## Release Notes

## v2.110.8

## 2.110.8 (2026-07-21)

### 🩹 Fixes

- **auth:** downgrade aborted/transient fetch failures from
console.error to warn
([#2544](supabase/supabase-js#2544))
- **functions:** clean up cross-signal abort listener on invoke() return
([#2487](supabase/supabase-js#2487))
- **functions:** match response Content-Type case-insensitively
([#2515](supabase/supabase-js#2515))
- **storage:** url-encode object key in CDN purge methods
([#2545](supabase/supabase-js#2545))
- **supabase:** skip Node warning in Deno
([#2541](supabase/supabase-js#2541))

### ❤️ Thank You

- Franco Kaddour @FrancoKaddour
- Katerina Skroumpelou @mandarini
- Pedro Henrique
- Vaibhav @7ttp
## v2.110.7

## 2.110.7 (2026-07-16)

### 🩹 Fixes

- **postgrest:** correct self-reference inference
([#2525](supabase/supabase-js#2525))
- **realtime:** trigger set auth on INITIAL_SESSION event
([#2531](supabase/supabase-js#2531))
- **realtime:** update phoenix to fix presence issue
([#2532](supabase/supabase-js#2532))

### ❤️ Thank You

- Eduardo Gurgel
- Filipe Cabaço @filipecabaco
- Vaibhav @7ttp

This PR was created automatically.

Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>
mandarini pushed a commit to supabase/ssr that referenced this pull request Jul 22, 2026
This PR updates `@supabase/supabase-js` to v2.110.8.

**Source**: supabase-js-stable-release

---

## Release Notes

## v2.110.8

## 2.110.8 (2026-07-21)

### 🩹 Fixes

- **auth:** downgrade aborted/transient fetch failures from
console.error to warn
([#2544](supabase/supabase-js#2544))
- **functions:** clean up cross-signal abort listener on invoke() return
([#2487](supabase/supabase-js#2487))
- **functions:** match response Content-Type case-insensitively
([#2515](supabase/supabase-js#2515))
- **storage:** url-encode object key in CDN purge methods
([#2545](supabase/supabase-js#2545))
- **supabase:** skip Node warning in Deno
([#2541](supabase/supabase-js#2541))

### ❤️ Thank You

- Franco Kaddour @FrancoKaddour
- Katerina Skroumpelou @mandarini
- Pedro Henrique
- Vaibhav @7ttp

This PR was created automatically.

Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

auth-js Related to the auth-js library.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

auth-js: GoTrueClient logs raw console.error when session recovery is aborted by page navigation

3 participants