Sentry reports AuthException(message: Invalid Refresh Token: Refresh Token Not Found, statusCode: 400)

[RCVZ]

Describe the bug
Sentry reports a couple of AuthException's
All of the reports are on iOS(But those are like 99% of my users)

To Reproduce
I have not been able to reproduce this with one of my own devices.

Version:
supabase_flutter 2.5.2
supabase 2.1.2
functions_client 2.1.0
gotrue 2.6.1
postgrest 2.1.1
realtime_client 2.0.4
storage_client 2.0.1

Additional context

AuthException(message: Invalid Refresh Token: Refresh Token Not Found, statusCode: 400)
  App                 0x10bb1abd4  GoTrueClient.notifyException (gotrue_client.dart:1206)
  App                 0x10bd5c604  GoTrueClient.recoverSession (gotrue_client.dart:995)
  File "<asynchronous suspension>"
  App                 0x10bd5c32c  SupabaseAuth.recoverSession (supabase_auth.dart:90)
  File "<asynchronous suspension>"
  App                 0x10bb1aa3c  CancelableCompleter.complete.<T> (cancelable_operation.dart:427)

[dshukertjr]

Duplicate of #928

[RCVZ]

@dshukertjr This is not a duplicate! This error states refresh token not found.

[dshukertjr]

@RCVZ Next time when you open an issue, you can give the issue a more descriptive name so that it does not look like a duplicate.

[dshukertjr]

Thanks for updating the title!

[Donaldd]

I've been getting the same issue. User is suddenly logged out of the app and then we get this error message (see below) from Sentry.

[devj3ns]

I get the same exception when I reopen my web app where I was previously logged in after a longer period of time. I am currently catching this error from the onAuthStateChange Stream but I am not sure how to handle it. When I reload the web-app, the user is logged out and everything works fine.

After digging into the _callRefreshToken method in the GoTrue client I found out that the user is automatically signed out on every AuthException which is not a AuthRetryableFetchException. There is also a test to ensure that the user is logged out when the refresh token is invalid.

In my app, even though I see the **** onAuthStateChange: AuthChangeEvent.signedOut log in my console when the "Invalid Refresh Token" exception is thrown, I don't receive the AuthChangeEvent.signedOut event when listening to the onAuthStateChange, instead I receive the exception and have to handle it in some way. Currently, I sign out the user manually, which seems to work.

@dshukertjr What is the preferred way to handle this exception?

I found some more information about this exception here:

• feat(gotrue, supabase_flutter): New auth token refresh algorithm #879
• fix: sign out on already used refresh token #740
• fix: handle invalid refresh token gotrue-dart#126

[RCVZ]

@dshukertjr When is this issue going to be fixed? 3 months have already passed!

[RCVZ]

@dshukertjr ???