Authentication cookies
Supabase authentication uses sb-… cookies, which may be split into several parts, to maintain and refresh your signed-in session. Server-set authentication cookies use HttpOnly and SameSite=Lax. Blocking them prevents normal use of private portal and administrator pages. Session cookies and refresh data can outlast the one-hour access token.
