How to secure public API endpoints in Supabase?

 

Step 1: Accessing the Supabase Dashboard

 

To secure public API endpoints in Supabase, first, access your Supabase project dashboard. Log in to your Supabase account and navigate to your project.

 

Step 2: Navigate to Authentication Settings

 

On the left-hand side panel, click on Authentication. This will take you to the authentication settings where you can manage user policies and API security.

 

Step 3: Configure Policies

 

Inside the Authentication panel, select the Policies tab. You will define Postgres Row Level Security (RLS) policies here to control access to your tables. This step ensures that only authenticated users can access certain API endpoints.

 

Example Policy to Allow Authenticated Users

 

To create a policy that allows only authenticated users to access data, execute the SQL command in your Supabase SQL editor:

-- Enable Row Level Security for your table
ALTER TABLE your_table_name ENABLE ROW LEVEL SECURITY;

-- Create a policy to allow authenticated users only
CREATE POLICY "Allow authenticated access"
ON your_table_name
FOR SELECT
USING (auth.role() = 'authenticated');

This policy authorizes only users with the authenticated role to access the data.

 

Step 4: Set Up API Key Restrictions

 

Navigate to the API tab from the left navigation. Ensure that your API keys are restricted appropriately:

1. Click on Generate API Key if you haven't generated keys yet.
2. Use the Service Role key for backend services where fulsome access to operations is required.
3. Use the Anon Key for public endpoints but with restricted access due to implemented RLS policies.

 

Step 5: Modify CORS (Cross-Origin Resource Sharing) Rules

 

CORS rules help secure your API endpoints by allowing or denying requests from specific domains:

• In the API section, scroll down to the CORS settings.
• Add your application’s domain to the allowed origins list.

https://your-application-domain.com

This setting ensures that only requests from specified domains can interact with your Supabase APIs.

 

Step 6: Secure Client Applications

 

Ensure the frontend applications use proper authentication methods like JWT (JSON Web Tokens) to send requests to your Supabase API. Import Supabase client library in your code and authenticate requests using users' JWT.

// Import the Supabase client
import { createClient } from '@supabase/supabase-js'

// Create a single supabase client for interacting with your database
const supabase = createClient('https://xyzcompany.supabase.co', process.env.SUPABASE_ANON_KEY)

// Authenticate user
async function fetchData() {
  const { data, error } = await supabase
    .from('your_table_name')
    .select('\*')

  if (error) console.error('Error fetching data:', error)
  else console.log('Fetched data:', data)
}

fetchData()

In the example above, ensure that you handle API keys with care and only expose the SUPABASE_ANON_KEY in client-side environments.

 

Step 7: Test Your Configuration

 

Finally, test your API endpoints to verify that access is indeed restricted only to authenticated users or specific domains as intended. Monitor logs to ensure unauthorized requests are blocked.