Hello,

recently I was working on a project entirely made by AI. at first it looked plausible but as I dig deeper into the code I found out ton of security issues. we solved the security issues one by one. ( thankfully the site isn’t released yet and only have beta testing users )

my question is that is it considered a security issue if I let the client ( browser ) make the supabase api call instead of routing those requests through the backend ( vercel ) even when I have made policies that prevents unauthorized users from submitting INSERT queries however I am still not sure if this is enough.

one thing that comes in my mind is that any authorized user can just spam the database and fill it with junk data but I think I can just ban that user and delete all the junk data relatively easily using a SQL query?

the thing is that I don’t want to refactor AI code and make it “use server” instead of “use client”. since I have to make a ton of changes and I am still learning Nextjs. ( thinking about using AI to fix AI code but I don’t think it will work and don’t want more AI slop in the codebase )

any suggestions are appreciated!

  • tyler
    21·
    21 hours ago

    What policies are preventing users from inserting data? If you are asking this question then you very likely should not be doing what you’re doing. There are ways to do it safely, but it’s for very very specific circumstances, with very very specific security setups.

    • ghodawalaamanOP
      1·
      21 hours ago

      What policies are preventing users from inserting data? okay, I just got confused there for a bit actually what’s happening is that I have created a policy on SELECT to prevent other users from accessing data of other users and it looks something like auth.uid() = user_id. iirc the policy to prevent INSERT looks something like this: auth.role() = 'authenticated'::text() so yeah only authenticated users can insert data but that doesn’t guaranty that client/user/browser will insert correct data.

      If you are asking this question then you very likely should not be doing what you’re doing. yes, I know that’s why I am asking for suggestions, I don’t have much experience in either supabase or Nextjs but I am learning :)

      There are ways to do it safely, but it’s for very very specific circumstances, with very very specific security setups. okay, so what do you suggest I should do. I can’t just shove more policies into the supabase to make it secure I think so the only way to make it secure is to have the server ( vercel ) do all the supabase calls and don’t share the supabase url so that the client can’t just query supabase. but again the reason I am not doing this is that it will require a very big refactor throughout the codebase. ( which I am terrified of T.T )

      • tyler
        2·
        21 hours ago

        I don’t really know jack about supabase, but what I’m getting at is that authentication is tied to a user store somewhere. So your user authenticates, they do so against something. Either your server or your database. If they do it against your database, then fine, but how did that user get created? How are they making the connection? How are your policies applied for that user? What keeps a user from spamming your database with login attempts to guess other users or your root db user?

        If your users have to authenticate against a server you don’t have to worry about the database. You can use a authentication library for your language and you’re good to go in most cases. You can then also scale your database separately.

        Maybe supabase is designed for this, idk, but I personally wouldn’t ever design a site that way, unless it was a very very niche circumstance.