The problem
@nhost/nhost-js uses Axios. Thus, the Nhost client can't be used in SSR if Nuxt is deployed as a Cloudflare worker.

This leads to await client.auth.refreshSession(refreshToken.value) failing in nhost.server.ts on page reload when SSR is used.

An experimental solution

1. Add this package: @vespaiach/axios-fetch-adapter
2. Use the follwing code in composables/useNhostClient.ts

import { NhostClient } from '@nhost/nhost-js';
import { useRuntimeConfig, useNuxtApp } from '#app'

// New: Axios fetch adapter for CF
import axios from 'axios'
import fetchAdapter from '@vespaiach/axios-fetch-adapter'

export const useNhostClient = (): NhostClient => {
  const nuxtApp = useNuxtApp()

  // New: Set the fetchAdapter as default
  axios.defaults.adapter = fetchAdapter

  const { nhost: { backendUrl } } = useRuntimeConfig().public

  if (!nuxtApp._nhostClient) {
    nuxtApp._nhostClient = new NhostClient({
      backendUrl: backendUrl
    })

  }

  return nuxtApp._nhostClient
}

This way, it works both in Miniflare (dev) and deployed as CF Worker.

Caveats

1. Depending on your NodeJS version, there is no native fetch support (so the local dev build won't work). There must be a check if the code is running on a CF Worker before applying the adapter.
2. If your domain is on Cloudflare, and you self-host Nhost / hasura-auth, it's very important to set SSL to "full" instead of "flexible" in the domain settings. Otherwise a Worker on app.domain.com can not fetch the hasura-auth backend on api.domain.com - the fetch will always fail (redirect loop).
3. If the fetch fails, either because of the CF SSL problem or because of no Axios support, there error might be "invalid or expired refresh token" although the token is fine. The error handling is bad for this case, see here: https://github.com/nhost/nhost/blob/main/packages/hasura-auth-js/src/hasura-auth-client.ts#L602 (Edit: something changed there, might be better now)

Cannot access Nhost datas in production on Netlify

Error messages :

In production, in the browser console, have :

• 404 POST error : https://PRODUCTION_URL/api/_nhost/session

Tests carried out

• With Nuxt 2 and Nhost JS SDK is working
• With Nuxt 3 and Nhost JS SDK is working

Solution ?

I think the problem comes from that we recover the URL of the site (front-end) and not from the API.
Maybe expecting : POST https://API_URL/api/_nhost/session ?

Is working with local build but no longer works in production.

Technos / versions / config : 
- Nuxt 3 : 3.0.0-rc.8
    - ssr : false
- nuxt-nhost : ^1.1.0

The bug
If the access token get's refreshed by the Nhost client, a hydration mismatch happens (if the access token is displayed) and further requests like page reloads fail, leading to log-out.

To Reproduce
Start the playground, login and wait until the token get's refreshed. Then reload or change the page to see the auth fail.

A possible solution
Adding the following code prevents the bug, but also adds an unecassary, second POST to /api/_nhost/session on each page reload.

plugins/nhost.client.ts: adding onTokenChanged in mounted hook

// Once Nuxt app is mounted
nuxtApp.hooks.hook('app:mounted', () => {
    // Listen to Nhost auth changes
    client.auth.onAuthStateChanged(async (event, session) => {
        await setServerSession(event, session)
        const nhostUser = client.auth.getUser()
        user.value = nhostUser
    })

    // Listen to Nhost token changes
    client.auth.onTokenChanged(async (session) => {
        await setServerSession('TOKEN_CHANGED', session)
        const nhostUser = client.auth.getUser()
        user.value = nhostUser
    })
})

server/api/_nhost/session.ts: adding TOKEN_CHANGED handler

if (signEvent === 'TOKEN_CHANGED') {
    if (!session) {
        throw new Error('Auth session missing!')
    }
    setCookie(
        event,
        `${cookieOptions.name}-access-token`,
        session.refreshToken, {
            domain: cookieOptions.domain,
            maxAge: cookieOptions.lifetime ?? 0,
            path: cookieOptions.path,
            sameSite: cookieOptions.sameSite
        }
    )
}

Right now, I can't think of a clean way to prevent the duplicated POST to /api/_nhost/session.