How to Secure Public API Endpoints in Supabase

1-- Enable RLS on all your public tables
2alter table public.profiles enable row level security;
3alter table public.posts enable row level security;
4alter table public.comments enable row level security;
5
6-- Verify RLS is enabled
7select tablename, rowsecurity
8from pg_tables
9where schemaname = 'public';

1-- Public read access (anon + authenticated)
2create policy "Anyone can read posts"
3  on public.posts for select
4  to anon, authenticated
5  using (published = true);
6
7-- Authenticated users can insert their own posts
8create policy "Users can create their own posts"
9  on public.posts for insert
10  to authenticated
11  with check ((select auth.uid()) = author_id);
12
13-- Users can only update their own posts
14create policy "Users can update own posts"
15  on public.posts for update
16  to authenticated
17  using ((select auth.uid()) = author_id)
18  with check ((select auth.uid()) = author_id);
19
20-- Users can only delete their own posts
21create policy "Users can delete own posts"
22  on public.posts for delete
23  to authenticated
24  using ((select auth.uid()) = author_id);

1-- Create a private schema for internal tables
2create schema if not exists private;
3
4-- Move sensitive tables out of public
5alter table public.internal_logs set schema private;
6
7-- Or revoke all API access to a specific public table
8revoke all on public.admin_settings from anon;
9revoke all on public.admin_settings from authenticated;

1// supabase/functions/_shared/cors.ts
2export const corsHeaders = {
3  'Access-Control-Allow-Origin': 'https://yourdomain.com',
4  'Access-Control-Allow-Headers': 'authorization, x-client-info, apikey, content-type',
5  'Access-Control-Allow-Methods': 'POST, GET, OPTIONS',
6};
7
8// In your Edge Function
9import { corsHeaders } from '../_shared/cors.ts';
10
11Deno.serve(async (req) => {
12  if (req.method === 'OPTIONS') {
13    return new Response('ok', { headers: corsHeaders });
14  }
15
16  // Your logic here
17  return new Response(JSON.stringify({ ok: true }), {
18    headers: { ...corsHeaders, 'Content-Type': 'application/json' },
19  });
20});

1// supabase/functions/rate-limited-api/index.ts
2import { createClient } from 'npm:@supabase/supabase-js@2';
3import { corsHeaders } from '../_shared/cors.ts';
4
5const rateLimits = new Map<string, { count: number; resetAt: number }>();
6
7Deno.serve(async (req) => {
8  if (req.method === 'OPTIONS') {
9    return new Response('ok', { headers: corsHeaders });
10  }
11
12  const clientIp = req.headers.get('x-forwarded-for') || 'unknown';
13  const now = Date.now();
14  const limit = rateLimits.get(clientIp);
15
16  if (limit && limit.resetAt > now && limit.count >= 100) {
17    return new Response(
18      JSON.stringify({ error: 'Rate limit exceeded' }),
19      { status: 429, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
20    );
21  }
22
23  if (!limit || limit.resetAt <= now) {
24    rateLimits.set(clientIp, { count: 1, resetAt: now + 60000 });
25  } else {
26    limit.count++;
27  }
28
29  // Forward to Supabase with service role for server-side operations
30  const supabase = createClient(
31    Deno.env.get('SUPABASE_URL')!,
32    Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')!
33  );
34
35  const { data, error } = await supabase.from('posts').select('*').limit(20);
36  return new Response(JSON.stringify(data), {
37    headers: { ...corsHeaders, 'Content-Type': 'application/json' },
38  });
39});

1# Test anonymous read access (should return only published posts)
2curl 'https://YOUR_PROJECT.supabase.co/rest/v1/posts?select=*&published=eq.true' \
3  -H 'apikey: YOUR_ANON_KEY' \
4  -H 'Authorization: Bearer YOUR_ANON_KEY'
5
6# Test anonymous insert (should fail with empty result)
7curl -X POST 'https://YOUR_PROJECT.supabase.co/rest/v1/posts' \
8  -H 'apikey: YOUR_ANON_KEY' \
9  -H 'Authorization: Bearer YOUR_ANON_KEY' \
10  -H 'Content-Type: application/json' \
11  -d '{"title": "hack", "author_id": "fake-uuid"}'