realworld VS auth-helpers

To illustrate my concerns, let's take the "Real World Example" that was made by the official Svelte Team in the official repository (https://github.com/sveltejs/realworld).

I often end up looking at https://github.com/sveltejs/realworld when I want to check how SvelteKit apps are "supposed" to be built. It's maintained by the Svelte team so you can learn good practices there.

I was looking at this a couple of hours ago and took a look at the realworld app app. I found all the fetch is done through the api, which is always called from server side. Even for user interaction, they always use forms to send the requests through the server.

I was looking at the realworld example and noticed that to login, they send a POST request to auth/login. auth/login then puts the data in an user object and sends it to an external API.

I'm pretty sure fetch is available for endpoints in latest version of svelte kit (older versions of svelte kit need to use node-fetch, updated svelte real world app has removed it as a dependency) but it's not working for me. Overview of my project files is below:

I’d recommend to take example from real world Svelte https://github.com/sveltejs/realworld

I have encountered a similar issue, but I haven't fully found a solution yet. Currently, I'm using the getSession function throughout my server components. Yesterday, I tried running a middleware to refresh the user's session, based on this example: https://github.com/supabase/auth-helpers/blob/main/examples/nextjs/middleware.tsx. This caught my attention because the comment mentioned that the middleware is necessary for any Server Component route using createServerComponentClient. Right now, I'm testing this approach, and so far, I haven't been logged out since yesterday. Do you have that in your application? The main difference between getSession and getUser in supabase is that getSession reads the cookies and is very fast (around 1-2 ms), while getUser makes a call to the supabase API with the access token to retrieve the user and I would assume they also verify the JWT on their end.

F.ex. Have a look how supabase-auth-helper-sveltekit works. This is the "SvelteKit way" to approach authentication. It also works perfectly with invalidate to reload or invalidate data that is connected to the current user session. As pointed out already, there is no reason you should not be able to access your JWT.

We have updated the Next.js Auth Helpers package to make it available across the client and server of the App Router. They also now implement server-side auth by default with PKCE - meaning the entire auth flow is now possible server-side.

Example

seems like known issue https://github.com/supabase/auth-helpers/issues/497

auth helper for sveltekit: https://github.com/supabase/auth-helpers/tree/main/packages/sveltekit

I do think checking auth in a server component would likely be better for your use here. Supabase has a nice example here: https://github.com/supabase/auth-helpers/tree/main/examples/nextjs-server-components They have a simple case with Middleware, but you wouldn't need to do it that way. Can use "redirect(/login)" from the server component.