3 ms·
I bet supabase also have a lot of naive users who haven't enabled RLS in their postgres instances (last I checked, not enabled by default), but are nevertheless
by smallerfish 2y ago
I bet supabase also have a lot of naive users who haven't enabled RLS in their postgres instances (last I checked, not enabled by default), but are nevertheless sharing api keys client side in their apps (https://supabase.com/docs/reference/javascript/initializing https://supabase.com/docs/reference/javascript/initializing).
Supabase support's defense is "well, if you read the manual you'll understand how to set this up properly", but that's not how bootcamp developers tend to work.
I spent 10 minutes seeing if I could convince google or kagi to search for sites like these, but unfortunately js isn't searchable in either.
- venkii 2y agoIt does at least look like their docs for the equivalent policy are not vulnerable to this attack though https://supabase.com/docs/guides/database/postgres/row-level-security#update-policies https://supabase.com/docs/guides/database/postgres/row-level... ie: The "Update Policies" DSL ensures that the user does not change the user id of a row
- yen223 2y agoSupabase nags you about RLS all the time.