fix(context): call getUser() before getSession() for security on server

packages/react/src/components/Auth/UserContext.tsx

@@ -1,5 +1,5 @@
-import React, { useEffect, useState, createContext, useContext } from 'react'
-import { SupabaseClient, Session, User } from '@supabase/supabase-js'
+import React, { createContext, useContext, useEffect, useState } from 'react'
+import { Session, SupabaseClient, User } from '@supabase/supabase-js'
 
 export interface AuthSession {
   user: User | null
@@ -20,6 +20,7 @@ export const UserContextProvider = (props: Props) => {
 
   useEffect(() => {
     ;(async () => {
+      await supabaseClient.auth.getUser()
       const { data } = await supabaseClient.auth.getSession()
       setSession(data.session)
       setUser(data.session?.user ?? null)

packages/solid/src/components/Auth/UserContext.tsx

@@ -1,10 +1,11 @@
-import { SupabaseClient, Session, User } from "@supabase/supabase-js";
+import { Session, SupabaseClient, User } from "@supabase/supabase-js";
 import {
   createContext,
   createEffect,
   createSignal,
   useContext,
 } from "solid-js";
+
 import { createStore } from "solid-js/store";
 
 export interface AuthSession {
@@ -29,6 +30,7 @@ export const UserContextProvider = (props: Props) => {
   });
 
   async function getSupabaseSession() {
+    await supabaseClient.auth.getUser()
     const { data } = await supabaseClient.auth.getSession();
     setSession(data.session);
     setUser(data.session?.user ?? null);