Automatic Session Refresh not Working

[MatthiasKroiss]

Since version 2.0.4 I think the automatic refresh of the session is not working properly on android. After login, it seems to work but then after a few hours the app crashes on start up with the following exception:

Fatal Exception: io.github.jan.supabase.exceptions.UnauthorizedRestException: JWT expired
Http Method: GET
       at io.github.jan.supabase.postgrest.PostgrestImpl.parseErrorResponse(PostgrestImpl.kt:47)
       at io.github.jan.supabase.gotrue.AuthenticatedSupabaseApiKt$authenticatedSupabaseApi$3.invoke(AuthenticatedSupabaseApi.kt:58)
       at io.github.jan.supabase.gotrue.AuthenticatedSupabaseApiKt$authenticatedSupabaseApi$3.invoke(AuthenticatedSupabaseApi.kt:58)
       at io.github.jan.supabase.network.SupabaseApi.rawRequest$suspendImpl(SupabaseApi.kt:25)
       at io.github.jan.supabase.network.SupabaseApi$rawRequest$1.invokeSuspend(:15)
       at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)
       at kotlinx.coroutines.DispatchedTask.run(DispatchedTask.kt:108)
       at androidx.compose.ui.platform.AndroidUiDispatcher.performTrampolineDispatch(AndroidUiDispatcher.android.kt:81)
       at androidx.compose.ui.platform.AndroidUiDispatcher.access$performTrampolineDispatch(AndroidUiDispatcher.android.kt:41)
       at androidx.compose.ui.platform.AndroidUiDispatcher$dispatchCallback$1.run(AndroidUiDispatcher.android.kt:57)
       at android.os.Handler.handleCallback(Handler.java:958)
       at android.os.Handler.dispatchMessage(Handler.java:99)
       at android.os.Looper.loopOnce(Looper.java:230)
       at android.os.Looper.loop(Looper.java:319)
       at android.app.ActivityThread.main(ActivityThread.java:8893)
       at java.lang.reflect.Method.invoke(Method.java)
       at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:608)
       at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1103)

Is there anything that I have to change in newer versions.
Thank you for your help.

[jan-tennert]

@MatthiasKroiss Hmm, there weren't any changes to auto refresh for the last 10 versions or something like that. I assume you didn't disable auto refresh in the auth config? And do you never see a log like "Session expired. Refreshing session..."? The session always gets refreshed 20% before the expiration, so it shouldn't be too late

[MatthiasKroiss]

This is my Android Application class that initializes the client:
` class PaperUI : Application() {

// Singleton for the Application Class
object instance {
    lateinit var supabaseClient: SupabaseClient
    lateinit var appContext: Context
}


override fun onCreate() {
    super.onCreate()
    instance.appContext = applicationContext

    // Initialize Supabase Client
    runBlocking {
        instance.supabaseClient = initSupabaseClient()
        Firebase.crashlytics.log("Init: SupabaseClient")
        instance.supabaseClient.auth.loadFromStorage(autoRefresh = true)
        Firebase.crashlytics.log("Init: LoadSessionFromStorage and autorefresh")
       
       // Test - DO NOT SHIP
        if (instance.supabaseClient.auth.currentSessionOrNull() != null) {
            instance.supabaseClient.auth.refreshCurrentSession()
        }
    }

}


fun initSupabaseClient(): SupabaseClient {
    val client = createSupabaseClient(
        supabaseUrl = com.aiui.paperui.BuildConfig.SUPABASE_URL,
        supabaseKey = com.aiui.paperui.BuildConfig.SUPABASE_ANON_KEY
    ) {
        install(Postgrest)
        install(Auth) {
            scheme = "aiui.paperui"
            host = "auth"
            defaultExternalAuthAction = ExternalAuthAction.CUSTOM_TABS
            alwaysAutoRefresh=true
        }
    }


    return client
}

}`
And thats my firebase crashlytics log, it seems that the client is not initialized again and the session gets not refreshed, but how can that be the case? The app was closed so it is a cold start.

Maybe it is because the client is initialized and the session is null (user not signed in) so auto refresh is not starting, but then the user signs in but autorefresh is not starting after login as it seems from the logs:

2024-02-06 14:49:58.747 21772-21772 Auth com.aiui.paperui D Logged out session in Supabase
2024-02-06 14:49:58.750 21772-21772 Auth com.aiui.paperui D Successfully logged out
2024-02-06 14:50:05.997 22913-22950 Auth com.aiui.paperui D Trying to load latest session
2024-02-06 14:50:05.997 22913-22913 AuthError com.aiui.paperui D Init Client
2024-02-06 14:50:06.121 22913-22913 Auth com.aiui.paperui D Starting auto refresh
2024-02-06 14:50:06.121 22913-22949 Auth com.aiui.paperui D No session found for auto refresh
2024-02-06 14:51:10.377 22913-22913 Auth com.aiui.paperui D Cancelling auto refresh because app is switching to the background

Thanks

[jan-tennert]

Okay a few things (looking at the code):

• You don't have to manually call instance.supabaseClient.auth.loadFromStorage(autoRefresh = true) if autoLoadFromStorage in the config is set to true (which is by default)
• I assume that the error occurs when switching from background back to the app? (Because at a full start, there shouldn't be a session in memory)
  So I think the problem is that when coming back from background, there is still a session saved in memory which is expired, but your app is using it anyway and the whole app crashes before the actual session can be refreshed.
  This is definitely a bug, how do you switch to your actual app once the user is authenticated?

[MatthiasKroiss]

Ok thanks, for the tip with the loadFromStorage call.
This is my code for switching to my actual app:

@Composable
fun Navigation() {
    val navController = rememberNavController()
    val session = PaperUI.instance.supabaseClient.auth.currentSessionOrNull()




    val startDestination = if (session != null) {
        // Set startDestination based on the user's session
        // Screen.Dashboard.route + "/{userId}" + session.user?.email
        Screen.Dashboard.route
    } else {
        Screen.Login.route
    }

[jan-tennert]

Okay, I'm integrating change which sets the session status back to LoadingFromStorage whenever the app goes into background. So you can collect the sessionStatus flow and change your Ui depending on the value (and it will never be Authenticated if the app just opened).
Example:

LaunchedEffect(Unit) {
    supabase.auth.sessionStatus.collect {
        when(it) {
            is SessionStatus.Authenticated -> {
                if(it.oldStatus !is SessionStatus.Authenticated) {
                    //Navigate to your app if the user is authenticated and this is the first time (so you don't navigate again on refresh)
                }
            }
            SessionStatus.LoadingFromStorage -> //Navigate to loading screen
            SessionStatus.NetworkError -> //...
            SessionStatus.NotAuthenticated ->  //Navigate to login screen
        }
    }
}

I'll publish a version later.

[MatthiasKroiss]

Thank you very much. Best repo maintainer.