Programming

26072 readers

77 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Follow the programming.dev instance rules
Keep content related to programming in some way
If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities !webdev@programming.dev

founded 2 years ago

MODERATORS

snowe@programming.dev

Ategon@programming.dev

UlrikHD@programming.dev

bugsmith@programming.dev

Spyro@programming.dev

is it a security issue that All the supabase requests are coming directly from client instead of the backend ( vercel ) ? (programming.dev)

submitted 2 days ago by ghodawalaaman@programming.dev to c/programming@programming.dev

7 comments fedilink hide all child comments

Hello,

recently I was working on a project entirely made by AI. at first it looked plausible but as I dig deeper into the code I found out ton of security issues. we solved the security issues one by one. ( thankfully the site isn't released yet and only have beta testing users )

my question is that is it considered a security issue if I let the client ( browser ) make the supabase api call instead of routing those requests through the backend ( vercel ) even when I have made policies that prevents unauthorized users from submitting INSERT queries however I am still not sure if this is enough.

one thing that comes in my mind is that any authorized user can just spam the database and fill it with junk data but I think I can just ban that user and delete all the junk data relatively easily using a SQL query?

the thing is that I don't want to refactor AI code and make it "use server" instead of "use client". since I have to make a ton of changes and I am still learning Nextjs. ( thinking about using AI to fix AI code but I don't think it will work and don't want more AI slop in the codebase )

any suggestions are appreciated!

you are viewing a single comment's thread
view the rest of the comments

[–] tyler@programming.dev 2 points 2 days ago

I don’t really know jack about supabase, but what I’m getting at is that authentication is tied to a user store somewhere. So your user authenticates, they do so against something. Either your server or your database. If they do it against your database, then fine, but how did that user get created? How are they making the connection? How are your policies applied for that user? What keeps a user from spamming your database with login attempts to guess other users or your root db user?

If your users have to authenticate against a server you don’t have to worry about the database. You can use a authentication library for your language and you’re good to go in most cases. You can then also scale your database separately.

Maybe supabase is designed for this, idk, but I personally wouldn’t ever design a site that way, unless it was a very very niche circumstance.