$ show supabase/ssr
This is the official Supabase SSR library (`@supabase/ssr`), a TypeScript package that provides `createBrowserClient` and `createServerClient` functions for using Supabase authentication in server-side rendering frameworks like Next.js, Remix, SvelteKit, and React Router. The library manages user sessions entirely via cookies, handling cookie chunking (splitting large JSON payloads across multiple cookies to respect browser size limits), base64url encoding for safe cookie values, and PKCE code verifier lifecycle. It exposes a `getAll`/`setAll` cookie interface that framework adapters implement to read and write cookies from request/response objects. The server client uses lazy session initialization and writes updated tokens back to cookies on auth state changes, with cache-control headers to prevent CDN caching of auth responses. The package also includes a `clearAuthCookiesAtScopes` migration helper for cleaning up stale cookies after domain/path changes. The codebase is well-tested, actively maintained, and follows modern TypeScript practices with strict mode and no top-level side effects.
The LLM identified 3 files worth highlighting for reuse:
A self-contained implementation of Base64-URL encoding and decoding that works directly with JavaScript strings and UTF-8 bytes, without relying on any external library. It handles UTF-16 surrogate pairs, validates UTF-8 sequences, and provides `stringToBase64URL`, `stringFromBase64URL`, `codepointToUTF8`, and `stringToUTF8` functions. This module is easily extractable and reusable in any project needing base64url encoding with proper Unicode support.
Implements cookie chunking logic that splits large values into multiple cookies (named `key.0`, `key.1`, etc.) while respecting browser size limits (default 3180 bytes). Crucially, it ensures splits occur at valid Unicode boundaries by using `encodeURIComponent`/`decodeURIComponent` to detect and avoid breaking multi-byte characters. Provides `createChunks`, `combineChunks`, `deleteChunks`, and `isChunkLike` functions. This pattern is reusable for any storage system that needs to handle oversized values across multiple keys.
A one-shot helper function that clears Supabase auth cookies at one or more explicit scopes (domain/path combinations). It issues `Set-Cookie` headers with `Max-Age=0` for every known chunk of the given storage key at each scope. Useful after deploying changes to cookie `Domain` or `Path` options to remove stale cookies that the runtime `signOut` cannot reach. The function is self-contained, well-documented, and can be extracted for similar cookie cleanup tasks in other projects.