Setting a custom cookie name breaks email signup flow

[novalex]

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

Initialising the Supabase client with cookieOptions containing a custom name (e.g. custom-name-auth-token) breaks the signup flow, as it no longer sets both custom-name-auth-token and custom-name-auth-token-code-verifier cookies.
Instead, the client tries setting 2 cookies with the same name, and the custom-name-auth-token cookie gets overridden with the code verifier value and fails to parse afterwards with Failed to parse cookie string: [Error: Unexpected format: String].
This also results in users being unable to verify their account via email link, as they see a invalid request: both auth code and code verifier should be non-empty error.

Example response headers when there is no custom cookie name set:

Set-Cookie: sb-localhost-auth-token-code-verifier=<code verifier>; Path=/; Expires=Fri, 07 Feb 3023 09:22:27 GMT; Max-Age=31536000000; Domain=localhost; HttpOnly; SameSite=strict
Set-Cookie: sb-localhost-auth-token=; Path=/; Max-Age=0

Example response headers when a custom cookie name is specified:

Set-Cookie: custom-name-auth-token=<code verifier>; Path=/; Expires=Fri, 07 Feb 3023 09:24:52 GMT; Max-Age=31536000000; Domain=localhost; HttpOnly; SameSite=strict

Logging Next.js' cookies().getAll() confirms the client is trying to set 2 cookies with the same name:

  { name: 'custom-name-auth-token', value: '', maxAge: 0, path: '/' },
  {
    name: 'custom-name-auth-token',
    value: '<code verifier>',
    path: '/',
    maxAge: 31536000000,
    domain: 'localhost',
    sameSite: 'strict',
    secure: false,
    httpOnly: true,
    expires: 3023-02-07T09:24:52.884Z
  }

Commenting out the name field of cookieOptions solves the issue, so I am certain it's a bug in the handling of custom cookie names/storageKey although I could not find an explanation when looking at the code for the auth-helpers or gotrue.

To Reproduce

1. Initialise Supabase route handler client with custom cookie options, e.g.:

import { cookies } from "next/headers"
import { createRouteHandlerClient } from "@supabase/auth-helpers-nextjs"
...

const supabase = createRouteHandlerClient<Database>({ cookies }, { cookieOptions: {
  name: "custom-name-auth-token",
  ...
}})

2. Perform user signup using the client, e.g.:

const { error } = await supabase.auth.signUp({
  email,
  password,
  options: {
	  emailRedirectTo: `<app url>/auth/callback`,
  },
})

3. Inspect the cookies set by Supabase, and/or the response headers, e.g.:

console.log("cookies after signup", cookies().getAll())

Expected behavior

The -auth-token and -auth-token-code-verifier cookies should both be set and not override each other.

The signup + email confirmation link should function as expected and not show errors to the users.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

• OS: [Ubuntu 20.04.6, MacOS]
• Browser (if applies) [Any]
• Version of supabase-js: [2.31.0]
• Version of Node.js: [18.16.1]

Additional context

Add any other context about the problem here.

[silentworks]

PR #674 should fix this issue.

[silentworks]

Had to revert this PR as it was causing breaks.

[atanaskanchev]

Any news on this one?

[ghost]

@silentworks is this still an issue?

[kangmingtay]

@nbarrow-inspire-labs @atanaskanchev this is no longer an issue and it has been fixed