From f0ff6cee8bf2f67f036c8f83f44c8db8be851e1b Mon Sep 17 00:00:00 2001
From: Charis <26616127+charislam@users.noreply.github.com>
Date: Thu, 29 May 2025 11:31:21 -0400
Subject: [PATCH] fix(common): prevent errors when accessing local storage in
 certain browser setups (#36003)

fix(common): prevent errors when accessing local storage in certain
browser setups

Got many reports of errors from accessing localStorage on Safari,
probably due to certain user security settings that cause the browser to
throw an error on storage access.
---
 packages/common/gotrue.ts | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/packages/common/gotrue.ts b/packages/common/gotrue.ts
index 309dd3ab51d..414e3c219ff 100644
--- a/packages/common/gotrue.ts
+++ b/packages/common/gotrue.ts
@@ -9,17 +9,28 @@ export const AUTH_NAVIGATOR_LOCK_DISABLED_KEY =
   process.env.NEXT_PUBLIC_AUTH_NAVIGATOR_LOCK_KEY ||
   'supabase.dashboard.auth.navigatorLock.disabled'
 
+/**
+ * Catches errors thrown when accessing localStorage. Safari with certain
+ * security settings throws when localStorage is accessed.
+ */
+function safeGetLocalStorage(key: string) {
+  try {
+    return globalThis?.localStorage?.getItem(key)
+  } catch {
+    return null
+  }
+}
+
 const debug =
-  process.env.NEXT_PUBLIC_IS_PLATFORM === 'true' &&
-  globalThis?.localStorage?.getItem(AUTH_DEBUG_KEY) === 'true'
+  process.env.NEXT_PUBLIC_IS_PLATFORM === 'true' && safeGetLocalStorage(AUTH_DEBUG_KEY) === 'true'
 
 const persistedDebug =
   process.env.NEXT_PUBLIC_IS_PLATFORM === 'true' &&
-  globalThis?.localStorage?.getItem(AUTH_DEBUG_PERSISTED_KEY) === 'true'
+  safeGetLocalStorage(AUTH_DEBUG_PERSISTED_KEY) === 'true'
 
 const shouldEnableNavigatorLock =
   process.env.NEXT_PUBLIC_IS_PLATFORM === 'true' &&
-  !(globalThis?.localStorage?.getItem(AUTH_NAVIGATOR_LOCK_DISABLED_KEY) === 'true')
+  !(safeGetLocalStorage(AUTH_NAVIGATOR_LOCK_DISABLED_KEY) === 'true')
 
 const shouldDetectSessionInUrl = process.env.NEXT_PUBLIC_AUTH_DETECT_SESSION_IN_URL
   ? process.env.NEXT_PUBLIC_AUTH_DETECT_SESSION_IN_URL === 'true'