Hi everyone,

I see there are some posts simular to this one from 2021 but i can seem to see anyhthing much more recent. If someone could point me in the right direction it would be appreaciated.

I'm encountering a very strange issue, and im sure its just something stupid and small that Im missing, with @supabase/supabase-js in my React application where the login promise hangs
indefinitely, but only when the credentials are correct.

The Environment:

• Tech Stack: React 19, Vite, TypeScript
• Hosting: Shared Hosting (Bluehost/Apache)
• Library: @supabase/supabase-js (v2)

The Behavior:

1. Wrong Password: If I enter an incorrect password, signInWithPassword resolves instantly with the expected "Invalid
   login credentials" error. This confirms my network and Supabase config are correct.
2. Correct Password: If I enter the correct password, the promise returned by signInWithPassword never resolves and
   never rejects. It just hangs indefinitely.

Debugging & The "Smoking Gun":
To debug this, I wrapped the signIn call in a Promise.race with a 20-second timeout.

Here is the crazy part: When my timeout triggers, I check supabase.auth.getSession(), and a valid session exists.

This means Supabase is successfully logging the user in on the backend, and the client has the token, but the
signInWithPassword promise itself is failing to resolve, causing my UI to hang in a "Loading..." state.

Code Snippet:

// LOGIN FLOW
const loginPromise = supabase.auth.signInWithPassword({
email,
password,
});

// My Safety Timeout
const timeoutPromise = new Promise((_, reject) =>
setTimeout(async () => {
// CHECK IF WE ARE ACTUALLY LOGGED IN?
const { data } = await supabase.auth.getSession();
if (data.session) {
console.log("Login promise hung, BUT session exists!");
// This is what is happening. The session is there, but loginPromise never finished.
}
reject(new Error("Timeout"));
}, 20000)
);

await Promise.race([loginPromise, timeoutPromise]);

What I've Tried:

• Clean Slate: I implemented a useEffect that wipes all localStorage (including sb-* keys) on mount to ensure no
  corrupted tokens are interfering.
• Network Check: Verified that I am not blocking websocket/API traffic (wrong password response is instant).

Has anyone seen signInWithPassword fail to resolve despite successfully establishing a session? Is there a race
condition in the client-side state persistence?

Any help would be appreciated