Should I shorten cookie Max-Age?
Usually no. Max-Age only controls how long the browser keeps the session cookie, not how long tokens are valid. When a shorter Max-Age is useful, and how to set it with @supabase/ssr.
Usually no. The cookie's Max-Age only decides how long the browser keeps the session cookie. It doesn't decide how long the access token works (that's the access token lifetime), and it doesn't revoke anything on the server. @supabase/ssr uses a long Max-Age, 400 days, so the refresh token survives between visits. Shorten it only if you want people to be signed out after a period without visiting.
What each lifetime controls
| Setting | What it controls | Where it's set |
|---|---|---|
| Access token lifetime | How long one access token is accepted (default one hour) | Your project's Auth settings |
| Refresh token | Lets the client get new access tokens; valid until it's used, revoked or the user signs out | Auth |
Cookie Max-Age |
How long the browser keeps the cookies that hold both tokens | Your app's @supabase/ssr options |
The cookies are written again every time the session refreshes, which is roughly once per access token lifetime while the user is active. A shorter Max-Age therefore works as an inactivity timeout: someone who keeps using the app stays signed in, and someone who doesn't come back within the window starts signed out.
When a shorter Max-Age makes sense
- An app used on shared or office computers, such as a front-desk bookings screen or an invoicing tool.
- A policy that says sessions end after N hours or days of inactivity.
It's a browser-side measure only. If someone copied the refresh token, it stays valid on the server. To really end sessions, call supabase.auth.signOut({ scope: "global" }) or have an admin sign the user out.
How to set it
Pass the same cookieOptions to the browser client, the server client and the proxy, or the next write will put the old value back:
const cookieOptions = { maxAge: 60 * 60 * 8 }; // 8 hours without a visit
// Browser
createBrowserClient(process.env.NEXT_PUBLIC_SUPABASE_URL!, process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!, {
cookieOptions,
});
// Server and proxy
createServerClient(process.env.NEXT_PUBLIC_SUPABASE_URL!, process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!, {
cookieOptions,
cookies: { getAll, setAll },
});
Keep Max-Age longer than the access token lifetime. Otherwise active users lose the cookie between refreshes and get signed out mid-session.
On SupaHost
- The access token lifetime is on Dashboard → your project → Auth tab → Sign-in & security → Access token lifetime (300 to 604,800 seconds).
- There's no session time-box or inactivity setting on the Auth tab, so a cookie
Max-Ageplus explicit sign-outs is the practical way to end idle sessions.