A user logging in is only the beginning of authentication.
Your application also needs to know whether the user is still authenticated.
That is the job of session management.
What Is a Session?
After authentication, Supabase provides session information that allows the application to identify the logged-in user.
The application can use that session when accessing protected functionality.
Protected Pages
Examples include:
/dashboard
/account
/settings
/billing
These pages should not be accessible as normal authenticated content when there is no valid session.
Session-Aware UI
The navigation can change based on authentication:
Guest:
Login | Sign Up
Authenticated:
Dashboard | Account | Logout
Logout
When the user logs out, the application should clear the authenticated state and return the user to an appropriate public page.
Refresh Behavior
Applications should also handle the case where a user refreshes the browser.
Authentication state should not unexpectedly disappear simply because the page was reloaded.
Server-Side Applications
Frameworks with server-side rendering need special attention to where authentication information is read.
Do not assume browser-only logic is sufficient for protected server-rendered pages.
Final Thoughts
Good session management makes authentication feel invisible to users.
The goal is simple:
Login should persist appropriately, protected pages should stay protected, and logout should reliably end the session.