supabase.auth.setSession and supabase.auth.updateUser do not resolve unless there is an error

[elitenas]

Summary
When using the Supabase client in an async function, both supabase.auth.setSession and supabase.auth.updateUser fail to resolve or return unless an error occurs. This blocks further execution in the code despite successful authentication or updates.

// Scenario 1: setSession
const { data, error } = await supabase.auth.setSession({
  access_token,
  refresh_token,
});
console.log('Setting session with token:', data, error); // Only logs if error occurs
console.log(data?.user); // Never reached if no error

// Scenario 2: updateUser
const { error: updateError } = await supabase.auth.updateUser({
  password: newPassword,
});
console.log('Update password error:', updateError); // Not called unless there's an error

Expected Behavior
Both methods should resolve regardless of whether there is an error, returning the appropriate data or null. Logging should be possible after the calls, and the behavior should be consistent with other auth methods like getSession.

Actual Behavior
setSession and updateUser appear to hang or do not return unless there's an error.

Causes the rest of the async function to not proceed, giving the illusion of being stuck.

Environment
Supabase JS SDK version: @supabase/supabase-js@2.9.9

Runtime: React Native / Expo (also affects Web SDK)

Additional Context
This issue is critical in flows like password recovery and token-based login where setSession or updateUser are required. It breaks user flows and leads to confusion.

[elitenas]

One of the issues is related to supabase/supabase#35911

[j4w8n]

Are you calling these methods inside of onAuthStateChange?

[elitenas]

No @j4w8n , here is relevant code:

const loginWithToken = async (
    access_token: string,
    refresh_token: string
  ): Promise<{ success: true; message: string } | { success: false; message: string }> => {
    try {
      const { error } = await supabase.auth.setSession({
        access_token,
        refresh_token,
      });

     // NEVER GETS HERE

      if (error) {
        throw error;
      }

      await supabase.auth.refreshSession();

      return {
        success: true,
        message: "Recovery session established.",
      };
    } catch (error: unknown) {
      let message = "Failed to establish recovery session.";
      if (error instanceof Error) {
        message = error.message;
      }
      return { success: false, message };
    }
  };

this is getting called on a click handler. It logs me in because onAuthStateChange triggers but when i console log after the setSession line, it doesn't even console log

useEffect(() => {

    const { data: { subscription } } = supabase.auth.onAuthStateChange(
      async (event, session) => {
        console.log('Auth state changed:', event, session?.user?.email);

        setSession(session);

        if (session?.user) {
          await loadUserProfile(session.user);
        } else {
          setUser(null);
        }

        setIsLoading(false);
      }
    );

    return () => {
      subscription.unsubscribe();
    };
  }, []);

This is onAuthStateChange code

[j4w8n]

Could be because of your loadUserProfile() call then. Calling an async function inside of onAuthStateChange is a bit tricky in general, but especially if it's awaiting another supabase call. So, is loadUserProfile calling any supabase methods?

[j4w8n]

Checkout bullet point four on this page: https://supabase.com/docs/reference/javascript/auth-onauthstatechange

[elitenas]

Yes, it does

const { data: profile, error } = await supabase
        .from('profiles')
        .select('email, name, avatar_url')
        .eq('id', authUser.id)
        .single();

which never returns after a setSession which actually might be the culprit here. Works fine with signInWithPassword() though. so definitely a bug. Whats a better way to handle this?

[j4w8n]

There is a workaround on that page

[elitenas]

Thank you @j4w8n you wouldn't consider this a bug then?

[j4w8n]

@elitenas idk how the team views it, but it's been a stumbling block for many people.

[antstu]

+1

[icopp]

I just ran into this, with a bunch of stuff just mysteriously not working until I worked through many different bits of functionality piece by piece back to onAuthStateChange. This is a bizarre design decision, why is the function I give an event listener blocking any other piece of code?