Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

SSR session refresh crashes on Vercel node runtime: h3 v2 setCookie reads event.res.headers.getSetCookie() -> 504

Aperta
  • Qualcosa non va?
#642 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
68/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
nuxt, typescript
Ambito
authentication, backend

Direzione di ricerca

Inizia da dist/runtime/utils/cookies.js, in particolare da setCookies e dal suo utilizzo di h3 setCookie/setHeader, quindi esamina la risposta node già ottenuta per il controllo della scrivibilità. Verifica la serializzazione dei cookie e la gestione di Set-Cookie ripetuti rispetto al comportamento esistente lato parsing. Il lavoro è concluso quando un aggiornamento della sessione SSR viene completato nel runtime node di Vercel senza l'errore getSetCookie e i cookie aggiornati raggiungono la risposta.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Version

@nuxtjs/supabase: 2.0.10
nuxt: 4.4.8 (nitropack 2.13.4)
@supabase/ssr: 0.12.6
Deploy: Vercel (node runtime, NITRO_PRESET=vercel)
h3 versions in tree: 1.15.11 (nitro's dep) + 2.0.1-rc.20 / rc.22 (hoisted by other nuxt 4.4 deps)

Reproduction Link

No public repro repo (private production app), but the trigger is minimal and
described exactly below. Happy to build a minimal repro repo if the maintainers
need one.

Steps to reproduce
  1. Nuxt 4 app using @nuxtjs/supabase with SSR enabled (default server plugin
    path) deployed to Vercel with the node runtime.
  2. Load any SSR route with a browser that already holds a Supabase session
    cookie whose access token needs refreshing (e.g. session older than the
    token lifetime, or after an idle period — the supabase-js client refreshes
    and calls setAll to write the new cookies).
  3. The SSR request crashes before responding:
    TypeError: Cannot read properties of undefined (reading 'getSetCookie')
    inside h3's setCookie, reached via the module's cookie setAll handler.
  4. The unhandled rejection keeps the request hanging; Vercel kills the function
    at its 15s limit → 504 Gateway Timeout to the visitor.

Relevant stack (production log):

TypeError: Cannot read properties of undefined (reading 'getSetCookie')
    at setCookie (.../chunks/_/h3.mjs:272:43)
    at setCookies (.../chunks/build/server.mjs:22958:5)
    at setAll (.../chunks/build/server.mjs:23059:39)
    at setAll (.../chunks/build/server.mjs:22686:11)
    at applyServerStorage (.../chunks/build/server.mjs:22807:9)
    at SupabaseAuthClient._notifyAllSubscribers (.../chunks/build/server.mjs:20153:7)
Vercel Runtime Timeout Error: Task timed out after 15 seconds
What is Expected?

SSR requests that refresh a Supabase session should complete normally and the
refreshed cookies should be written to the response, on every deploy target —
including Vercel's node runtime.

What is actually happening?

The module's shared cookie util (dist/runtime/utils/cookies.js) writes auth
cookies through h3's setCookie/setHeader:

import { setCookie, setHeader } from 'h3'
// ...
setCookie(event, name, value, options)

h3 v1 (1.15.x, the version nitropack 2.13.4 declares) implements
setCookie node-safely — it writes via event.node.res.setHeader(...). h3
v2 rc (2.0.1-rc.20/rc.22, hoisted elsewhere in a nuxt 4.4 tree) rewrote
setCookie to Web-standard semantics:

const currentCookies = event.res.headers.getSetCookie()  // h3 v2

On the Vercel build the module's import ... from 'h3' resolves to the h3 v2
copy (separate chunk from nitro's node-safe v1 copy), but the runtime event
still carries a node-shaped res (ServerResponse — no .headers
property). So event.res.headers is undefined and getSetCookie throws —
inside supabase-js's session-refresh notification path, as an unhandled
rejection, leaving the request hanging until the platform timeout.

Related: the same file pair's getAll had the mirror-image crash on Vercel —
getHeader(event, 'Cookie') in h3 v2 reads event.req.headers.get(...) which
isn't a function on the node req — we patched that locally in 2026-09-08 with a
node-safe header read (event.node?.req ?? event.req), and hit this write-side
twin on 2026-09-10. Both halves trace to the module importing h3 helpers whose
node/web semantics diverged between h3 v1 and v2 without the module pinning
either.

Suggested fix direction

Write the cookies against the node response directly instead of routing through
h3's web-standard setCookie (mirroring h3 v1's own node-safe implementation):

// node-safe write: appendHeader handles repeated Set-Cookie correctly
response.appendHeader('Set-Cookie', serializeCookie(name, value, options))

where response = event.node.res (the module's setCookies already grabs it
for the writability check). Serialization should mirror cookie-es so the wire
format and the parse-side round-trip are unchanged. Our local patch does
exactly this and the Vercel build artifact is verified clean; a real upstream
fix would also pin or otherwise not depend on which h3 major resolves.

Lingua principale
TypeScript
Stelle
941
Fork
158
Merge medio
6g 9h
PR unite (30g)
3

Preparare l'ambiente

  • Nessun Dockerfile né file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di nuxt-modules/supabase

Tutte le issue di nuxt-modules/supabase

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.