Your Supabase is public if you turn off RLS
skilldeliver.com
Your Supabase is public if you turn off RLS
1–10 of 69 posts
Re: Your Supabase is public if you turn off RLS
#2So like MongoDB twenty-odd years ago?
Re: Your Supabase is public if you turn off RLS
#3Supabase doesn’t make a public users table by default. The user schema is in auth and secured. The problem is that unskilled developers bypass those controls out of convenience and put data into Public without RLS. Even the Supabase docs warn against this.
Re: Your Supabase is public if you turn off RLS
#4Supabase doesn’t make a public users table by default. The user schema is in auth and secured. The problem is that unskilled developers bypass those controls out of convenience and put data into Public without RLS. Even the Supabase docs warn against this.
[deleted]
Re: Your Supabase is public if you turn off RLS
#5Supabase doesn’t make a public users table by default. The user schema is in auth and secured. The problem is that unskilled developers bypass those controls out of convenience and put data into Public without RLS. Even the Supabase docs warn against this.
The point is that why they even have to make new users table? Something is driving them in this direction and as a counterexample you have Pocketbase where you don't have to.
Re: Your Supabase is public if you turn off RLS
#6Supabase doesn’t make a public users table by default. The user schema is in auth and secured. The problem is that unskilled developers bypass those controls out of convenience and put data into Public without RLS. Even the Supabase docs warn against this.
The point is that why they even have to make new users table? Something is driving them in this direction and as a counterexample you have Pocketbase where you don't have to.
To store application-specific data about users. The Supabase doc or examples show this. Where else would you put such data?
But what the docs don't cover is the provided Users table. Missing documentation is why I gave up on Supabase; and the Users table was one of the first problems I encountered. I could find no details on what to expect in each column at any given time.
Upon creating a new user, values get set in this table for no apparent reason. So if your application depends on knowing the verification status of a new user (for example), good luck... Supabase claimed every user was verified upon creation.
Re: Your Supabase is public if you turn off RLS
#7Firebase seems to suffer a similar problem of people not setting permissions right. The only major difference is that they seem to steer devs pretty aggressively to Google auth which won't leak password hashes.
While in theory your API can be the database it seems like a footgun for the inexperienced and AI.
Re: Your Supabase is public if you turn off RLS
#8> I think what's happening is people are creating additional public users tables and not setting proper RLS for them
Yep: https://supabase.com/docs/guides/auth/managing-user-data
> For security, the Auth schema is not exposed in the auto-generated API. If you want to access users data via the API, you can create your own user tables in the public schema.
Re: Your Supabase is public if you turn off RLS
#9My experience with supabase is it does actually warn you constantly if you don't set up RLS
Re: Your Supabase is public if you turn off RLS
#10My experience with supabase is it does actually warn you constantly if you don't set up RLS
You assume people read. :)