MaGnezij
10/27/2022, 7:49 AMflapili (FR, bad EN)
10/27/2022, 8:23 AMnitehawk
10/27/2022, 8:55 AMHam
10/27/2022, 12:01 PMGaryLake
10/27/2022, 12:29 PMglatocha
10/27/2022, 1:15 PMturner
10/27/2022, 1:44 PMaccess_token
or any authentication to the db call's that trigger the policies configured in the Supabase dashboard? Or are the database policies only applied when using the Supabase API? Sorry if that's a dumb question, happy for your help!Brian
10/27/2022, 3:23 PMinsert()
directly from the client and set RLS to allow anyone to insert (seems dangerous though, even with a honeypot field). The form fields would insert into a temp table with a status
of pending_verification
. I'd then send an email verification to the form submitter (based on the email they supply). Once they click to verify the email, that will trigger a function which sets the status
= verified
. A db trigger can then take the data out of the temp table and insert()
to all of the correct relational tables (application, customer, address, etc).
Is this over engineering?
How else can I secure this web form from spam?
How could I better solve this use case?James Q Quick
10/27/2022, 5:22 PMGaryLake
10/27/2022, 5:31 PMWITH
http AS (
SELECT * FROM http_get('http://httpbin.org/image/png') -- works, but no other url I does...
),
headers AS (
SELECT (unnest(headers)).* FROM http
)
SELECT
http.content_type,
length(textsend(http.content)) AS length_binary,
headers.value AS length_headers
FROM http, headers
WHERE field = 'Content-Length';
So my question is two fold:
1) There's a general, "am I going about this the right way?"
2) Then to at least help me along my way, why does the pgsql-http example work with the example URL, but no others I try do?reed
10/27/2022, 7:37 PM<style>
tag with css<script src=3D"/cdn-cgi/apps/head/bnFc2aq0fsRO37Lg0zTgaqOnJ1E.js"></script>=
Does anyone know why this is? Is it preventable? I think it's contributing to my emails getting caught in spam filters.louwers
10/27/2022, 7:40 PMnvr
10/27/2022, 7:53 PMgtims123
10/27/2022, 8:14 PMkomagata
10/27/2022, 9:54 PMnvr
10/27/2022, 10:31 PMsudoramen
10/27/2022, 11:11 PMjs
const { data, error } = await supabase.auth.admin.getUserById(1)
I tried this with a valid token but get an error "user_id must be an UUID"
. I'm assuming this line of code got copied over without being fixed, how can I get the user calling the edge function? (context: this is being used in an edge function)
I also tried
js
const { data: { user } } = await supabase.auth.getUser(jwt)
but get { data: { user: null }, error: AuthApiError { name: "AuthApiError", message: "Internal server error", status: 500 } }
back.hyodo
10/28/2022, 1:34 AMAskar
10/28/2022, 3:21 AMconsole.log
both of the .env
params and they did show up. So i'm not sure why I'm getting the error `{"message":"No API key found in request","hint":"No apikey
request header or url param was found."}` when I try to authenticate with Twitter.
.env
js
NEXT_PUBLIC_SUPABASE_URL="supabaseurl"
NEXT_PUBLIC_SUPABASE_ANON_KEY = "anonkey"
index.js
js
import supabaseClient from "../utils/supabaseClient.js"
export default function Home(props) {
async function signInWithTwitter() {
const supabase = supabaseClient()
console.log(supabase)
console.log(process.env.NEXT_PUBLIC_SUPABASE_URL, process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY)
const { data, error } = await supabase.auth.signInWithOAuth({
provider: 'twitter',
})
console.log(data, error)
}
return (<TwitterButton/>)
utils/supabaseClient.js
js
import {createClient} from "@supabase/supabase-js"
const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
console.log("something", supabaseUrl, supabaseAnonKey)
// const supabase = createClient(supabaseUrl, supabaseAnonKey);
export default function supabaseClient() {
return createClient(supabaseUrl, supabaseAnonKey);
}
Thoth Trismegistus
10/28/2022, 5:18 AMSacha
10/28/2022, 8:45 AMDesmond
10/28/2022, 9:12 AMSupabase supabase = await Supabase.initialize(
url: _config.databaseUri,
anonKey: _config.databaseAnonKey,
);
_supabaseClient = supabase.client;
and
await _supabaseClient.auth.resetPasswordForEmail(email);
Pretty much any other auth function works like a charm (our app also does signups, signins, database access, etc.), but resetPasswordForEmail
always gives me a 500 from the server, "Unable to process request".
Is there a configuration I'm overlooking? Is this a problem specific to our account?
(I can probably make a minimal project to reproduce this issue, if anyone is interested)
Many thanks!flapili (FR, bad EN)
10/28/2022, 9:36 AMnitehawk
10/28/2022, 10:03 AMBrian
10/28/2022, 2:50 PMupsert()
method since users can update fields (it's a multi-step form with incremental saves). It appears I have to enable a SELECT policy in order for the upsert()
to work. Is this true? Any other way to secure the table data more?
I am using { returning: 'minimal' }
in my upsert()
method but it still fails (violates row-level security policy) without the SELECT policy in place.Cheqo
10/28/2022, 3:09 PMAskar
10/28/2022, 3:32 PMSiddharth
10/28/2022, 4:08 PMAviv
10/28/2022, 6:00 PMitisnajim
10/28/2022, 6:41 PMsupabase init
& supabase start
?
variables like user and pass!