Once the user has received a password reset email, a code is provided by supabase auth in the redirect URL.

It will be looking like this : https://your_app/your_redirect?code=

This code can be exchanged to a session:

    const { data, error } = await supabase.auth.exchangeCodeForSession(code)

Then you can update the user password without "Auth Session Missing Error"

Now Supabase has a new package in SSR that avoid this problem redirecting to an api route in next.js. You need to use the new SSR package Package here.

To avoid this problem I use this guide: SSR reset password

I hope it work for you!

I’ve spent a considerable amount of time troubleshooting this issue on React Native/Expo, and here’s the solution that finally worked for me. Basically this catch the supabase deeplink redirection and iniatiate a user session using the access token and refresh token included in the redirection url. I found the solution here : https://blog.theodo.com/2023/03/supabase-reset-password-rn/

import * as Linking from "expo-linking";

Linking.addEventListener("url", async (event) => {
  const parseSupabaseUrl = (url: string) => {
    let parsedUrl = url;
    if (url.includes("#")) {
      parsedUrl = url.replace("#", "?");
    }
    return Linking.parse(parsedUrl);
  };
  const url = parseSupabaseUrl(event.url);

  console.log("parsed url", url);

  const { data: setSessionData, error: setSessionError } =
    await supabase.auth.setSession({
      access_token: url.queryParams.access_token,
      refresh_token: url.queryParams.refresh_token,
    });
  console.log("setSessionData", setSessionData);
  console.log("setSessionError", setSessionError);
});

supabase store cookie in the browser when you call

const { error } = await supabase.auth.updateUser({
   password: password,
});

when you open reset password link from other device or browser then it throw this error because the cookie is missing.

export const onGet: RequestHandler = async ({ query, cookie }) => {

    const supabase = createServerPkceClient(cookie);
    supabase.auth.onAuthStateChange(async (event, session) => {
        if (event == "PASSWORD_RECOVERY") {

            const obj: Record<string, string> = {};
            query.forEach((v, k) => (obj[k] = v));

            if (obj.code) {
                try {
                    const { error, data } = await supabase.auth.exchangeCodeForSession(obj.code);
                    if (error) {
                        console.log('Error exchanging auth code for session:', error.message)
                    } else {
                        console.log('Session data:', data)
                    }
                } catch (error) {
                    console.error('Error during code exchange:', error);
                }
            }
            console.log('password recovery event occured')
            console.log(event, session)
        }
    })
} 

This is how i handle supabase password reset in qwik js , make sure supabse

After got the mail from resetpasswordforemail method, then click the link and its redirect to the reset-password page (you have to create that page in nextjs). Then, before to call the method of updateUser from supabase, you have to ensure the authenticated user. So, use the setSession method for whether check valid user or not that method expecting two value one access_token. Another one is refreshToken, these values are present in the URL, it from resetPasswordforemail.

My code look like this:

const { data : setSessionData, error : setSessionError } = await supabase.auth.setSession({
      access_token :accessToken,
      refresh_token :refreshToken
    })

Using SSR + Pkce flow works. However make sure to have the used cookies whitelisted since i wasted 2 whole days not realizing “Auth season missing” since the cookies didn’t get placed in case you are using a cookie manager 😩