page:start await getClaims() hangs every navigation when JWKS fetch stalls

[samweinkauf]

Related to #565 / #594 — same page:start code path, additional failure mode (navigation hang) that strengthens the case for the fix proposed in #594.

Version

@nuxtjs/supabase: v2.0.6
nuxt: v4.4.2
@supabase/supabase-js: v2.46+ (any version with getClaims())

Reproduction

(minimal repo — requires a Supabase project with asymmetric JWT signing keys enabled, where the JWKS endpoint is unreachable, slow, or blocked by CORS)

Steps to reproduce

1. Nuxt 4 app with ssr: false, @nuxtjs/supabase@2.0.6, useSsrCookies: false, signed in.

2. Add a minimal target page:

   <template><div>hi</div></template>
   <script setup>const u = useSupabaseUser()</script>

3. Click any in-app NuxtLink to that page (any client-side navigation).

What is Expected?

Navigation completes and the page renders. Populating useSupabaseUser() should never block the navigation — at worst, the user value should hydrate asynchronously.

What is actually happening?

Navigation hangs indefinitely; the destination page never renders. The Nuxt-awaited page:start hook in the v2 client plugin awaits client.auth.getClaims():

nuxtApp.hook('page:start', async () => {
  const { data } = await client.auth.getClaims()
  currentUser.value = data?.claims ?? null
})

getClaims() (supabase-js v2.46+) verifies the JWT, which fetches JWKS from the Supabase project when asymmetric signing keys are in use. If that fetch stalls or fails (CORS, project misconfiguration, transient network), navigation never completes because Nuxt is awaiting the hook.

This compounds the timing issues already discussed in #565 / #594: page:start isn't just the wrong place because it runs too late on refresh — it's also dangerous to await there because every navigation becomes blocked on Supabase availability. This is a regression vs. v1.x, which populated the user from the session synchronously without any verification network call, so navigation was never blocked on Supabase.

Suggestions:

• The fix proposed in useSupabaseUser() returns null in middlewares on page refresh (SPA mode) #565 / fix: populate user claims alongside session in SPA mode #594 (move getClaims() out of page:start into the setup() block, called once) would incidentally fix this as well, since the call no longer fires per-navigation.
• If page:start must keep populating claims for any reason, fire it without await so navigation isn't blocked.
• Consider falling back to local JWT decoding if the JWKS fetch fails, so a JWKS outage doesn't take the entire app offline.