Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Supabase Auth: SSO, Mobile, and Server-Side Support

supabase.com

Post reply on HN
Print view View original

61–68 of 68 posts

Re: Supabase Auth: SSO, Mobile, and Server-Side Support

#61

Post by laktek »

andymitchell wrote: post #48
kiwicopple wrote: post #28

Earlier quoted context omitted.

> logs for their compliance Supabase Logs will be fully-integrated with the rest of the supabase stack. Since the Auth JWT flows through the HTTP Authorization header, into PostgREST, then into Postgres, we can pluck the Supabase User ID out of the JWT and store it alongside every log entry. You will be able to reference/join every authorized action in your database to an authenticated user. > RLS can't control acces…

Replacing Kong with Deno is a great step (and by simplifying the stack, in line with the elegance I love Supabase for). - My request with Supabase Logs is that they're easy to format in ways auditors expect (i.e. similar to major tools). That would be a headline benefit, because: [1] As your customer, I have an easier time with SOC2 [2] In turn, I can pitch that to our enterprise customers: "your compliance will be e…

Hey Andy,

If you use Supabase CLI to serve functions locally, you can use the `--no-verify-jwt` flag, ie. `supabase functions serve --no-verify-jwt` will skip JWT checks locally.

Is that what you're after? if you have any further issues with serving functions locally, can follow up on the support ticket.

Re: Supabase Auth: SSO, Mobile, and Server-Side Support

#62

Post by kangmingtay »

mkl95 wrote: post #53

Supabase are killing it. I wish they had a Terraform provider.

Actually, we are experimenting with a Terraform provider to manage a project configuration, starting with Auth.

What are some other things you'd like to see in the Terraform provider?

[1]: supabase-terraform (https://github.com/supabase-community/supabase-terraform)

Re: Supabase Auth: SSO, Mobile, and Server-Side Support

#63

Post by kangmingtay »

xcskier56 wrote: post #36

Been doing a lot of Auth related stuff the last day or two so in classic HN style this is very timely for me! One of the things that I really dislike about most auth providers is that it is very hard to implement login in your native UI. It almost always requires a redirect to a hosted UI page that is very clearly not your UI. We've found this a poor and potentially confusing user experience when you just need a form…

If you're using Flutter, we do have a chat app example that has a basic email + password login. (https://github.com/supabase-community/flutter-chat)

Re: Supabase Auth: SSO, Mobile, and Server-Side Support

#64

Post by niklasd »

kiwicopple wrote: post #60
niklasd wrote: post #56

Earlier quoted context omitted.

Some additional feedback: In my opinion testing RLS is a problem. Additionally, I find it hard to keep a good overview over the rules. E.g., in a multi-tenant application one needs to secure every table with a restrictive rule, and it's easy to make a rule permissive, since that is the default & it's not indicated in the Studio UI. When generating migrations with 'supabase db diff' views are being recreated without '…

we have a lot of work to do for migrations and testing, especially RLS. for this Launch Week we focused on generating policies (more on that in tomorrows launch week). This is hard for a lot of our audience who aren't familiar with SQL. In the next few months we'll work on simulating a policy - being able to choose a specific user and see what data would be returned for that user. We also have `supabase test db`, in…

Great, thank you for the reply! The simulation a policy sounds exciting. Looking forward to the news.

Re: Supabase Auth: SSO, Mobile, and Server-Side Support

#66

Post by kiwicopple »

niklasd wrote: post #64
kiwicopple wrote: post #60

Earlier quoted context omitted.

we have a lot of work to do for migrations and testing, especially RLS. for this Launch Week we focused on generating policies (more on that in tomorrows launch week). This is hard for a lot of our audience who aren't familiar with SQL. In the next few months we'll work on simulating a policy - being able to choose a specific user and see what data would be returned for that user. We also have `supabase test db`, in…

Great, thank you for the reply! The simulation a policy sounds exciting. Looking forward to the news.

follow up on the "security invoker" - we've filed a bug report here which you can follow: https://github.com/djrobstep/schemainspect/issues/86

Re: Supabase Auth: SSO, Mobile, and Server-Side Support

#67

Post by chasers »

andymitchell wrote: post #48
kiwicopple wrote: post #28

Earlier quoted context omitted.

> logs for their compliance Supabase Logs will be fully-integrated with the rest of the supabase stack. Since the Auth JWT flows through the HTTP Authorization header, into PostgREST, then into Postgres, we can pluck the Supabase User ID out of the JWT and store it alongside every log entry. You will be able to reference/join every authorized action in your database to an authenticated user. > RLS can't control acces…

Replacing Kong with Deno is a great step (and by simplifying the stack, in line with the elegance I love Supabase for). - My request with Supabase Logs is that they're easy to format in ways auditors expect (i.e. similar to major tools). That would be a headline benefit, because: [1] As your customer, I have an easier time with SOC2 [2] In turn, I can pitch that to our enterprise customers: "your compliance will be e…

I work on logs at Supabase.

What format(s) would you need?

Re: Supabase Auth: SSO, Mobile, and Server-Side Support

#68

Post by chasers »

andymitchell wrote: post #48
kiwicopple wrote: post #28

Earlier quoted context omitted.

> logs for their compliance Supabase Logs will be fully-integrated with the rest of the supabase stack. Since the Auth JWT flows through the HTTP Authorization header, into PostgREST, then into Postgres, we can pluck the Supabase User ID out of the JWT and store it alongside every log entry. You will be able to reference/join every authorized action in your database to an authenticated user. > RLS can't control acces…

Replacing Kong with Deno is a great step (and by simplifying the stack, in line with the elegance I love Supabase for). - My request with Supabase Logs is that they're easy to format in ways auditors expect (i.e. similar to major tools). That would be a headline benefit, because: [1] As your customer, I have an easier time with SOC2 [2] In turn, I can pitch that to our enterprise customers: "your compliance will be e…

Also fwiw, if this is self-hosted I'm sure you can export them from BigQuery in an acceptable format.

And if this is Supabase hosted, you can reach out to support and we can do that for you.

Log drains is high on the list for the hosted platform too.

Post reply on HN