fix(auth): include Cloudflare error codes in NETWORK_ERROR_CODES#2239
Merged
mandarini merged 1 commit intosupabase:masterfrom Apr 15, 2026
Merged
Conversation
Expanded NETWORK_ERROR_CODES to include Cloudflare-specific error codes.When Supabase is deployed behind Cloudflare and the server goes down, Cloudflare responds with HTTP 5xx codes (521 'Web server is down', 520 'Unknown error', 522 'Connection timed out', etc.). Previously, only 502/503/504 were treated as retryable network errors - other 5xx codes would fall through to be parsed as auth API errors, potentially wiping the user session token. Fix: Add Cloudflare-specific error codes (520-524, 530) to NETWORK_ERROR_CODES so they are correctly treated as retryable infrastructure errors via AuthRetryableFetchError, not as auth failures. Fixes supabase#1684
mandarini
approved these changes
Apr 15, 2026
@supabase/auth-js
@supabase/functions-js
@supabase/postgrest-js
@supabase/realtime-js
@supabase/storage-js
@supabase/supabase-js
commit: |
mandarini
added
do-not-merge
mandarini
pushed a commit
to supabase/supabase
that referenced
this pull request
Apr 16, 2026
This PR updates @supabase/*-js libraries to version 2.103.2. **Source**: supabase-js-stable-release **Changes**: - Updated @supabase/supabase-js to 2.103.2 - Updated @supabase/auth-js to 2.103.2 - Updated @supabase/realtime-js to 2.103.2 - Updated @supabase/postgest-js to 2.103.2 - Refreshed pnpm-lock.yaml --- ## Release Notes ## v2.103.2 ## 2.103.2 (2026-04-15) ### 🩹 Fixes - **auth:** include Cloudflare error codes in NETWORK_ERROR_CODES ([#2239](supabase/supabase-js#2239)) - **auth:** remove Prettify wrapper from exported types for TypeDoc expansion ([#2250](supabase/supabase-js#2250)) - **misc:** add explicit return types to toJSON methods for JSR compat ([#2252](supabase/supabase-js#2252)) - **storage:** remove client-side signed URL render endpoint normalization ([#2249](supabase/supabase-js#2249)) ### ❤️ Thank You - Katerina Skroumpelou @mandarini - Vansh Sharma @Vansh1811 ## v2.103.1 ## 2.103.1 (2026-04-15) ### 🩹 Fixes - **auth:** add toJSON to AuthError for correct JSON serialization ([#2238](supabase/supabase-js#2238)) - **postgrest:** handle bigint rpc ([#2245](supabase/supabase-js#2245)) - **storage:** add toJSON to StorageError for correct JSON serialization ([#2246](supabase/supabase-js#2246)) - **storage:** apply empty transform check to download and getPublicUrl ([#2219](supabase/supabase-js#2219)) ### ❤️ Thank You - oniani1 - Vaibhav @7ttp This PR was created automatically. Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
When Supabase is deployed behind Cloudflare and the server goes down, Cloudflare responds with HTTP
5xxerror codes that are not standard HTTP codes:520— Unknown error521— Web server is down522— Connection timed out523— Origin is unreachable524— A timeout occurred530— Cloudflare 1xxx errorPreviously,
NETWORK_ERROR_CODESonly included[502, 503, 504]. When Cloudflare returned a521(or similar),handleErrorwould fall through to parse the response body as an auth API error — which would fail (since the Cloudflare HTML error page isn't valid JSON), and in some cases cause the auth client to wipe the user's session token as if it were an auth failure.What changed?
packages/core/auth-js/src/lib/fetch.ts: ExtendedNETWORK_ERROR_CODESto include Cloudflare-specific error codes (520,521,522,523,524,530). These are now correctly classified as retryable infrastructure errors (AuthRetryableFetchError) instead of auth API errors.Checklist
Fixes #1684