Hey all! Is there a way to VerifyToken from supabase to independent microservices ? Like the Login, user management can stay in supabase itself, but when the JWT is passed to some other backend service (example python service), the python service can Verify the token and then send back the response ?

Hello @zhukov! This thread has been automatically created from your message in #843999948717555735 a ``few seconds ago``. Pinging @User so that they see this as well! Want to unsubscribe from this thread? Right-click the thread in Discord (or use the ... menu) and select Leave Thread to unsubscribe from future updates. Want to change the title? Use the

/title

command! We have solved your problem? Click the button below to archive it.

Any help is appreciated! Thanks.

yes, im currently doing this in my python api

Can you point me to a documentation around this @Vidski

Im currently using falcon and implemented a middleware to verify jwts

python
import jwt
from falcon import HTTPUnauthorized


class JwtChecker:
    def __init__(self, secret='', algorithm='', exempt_routes=None,
                 exempt_methods=None, issuer=None, audience=None, leeway=0):

        self.secret = secret
        self.algorithm = algorithm
        self.exempt_routes = exempt_routes or []
        self.exempt_methods = exempt_methods or []
        self.issuer = issuer
        self.audience = audience
        self.leeway = leeway

        algorithms = [
            'HS256', 'HS384', 'HS512',
            'ES256', 'ES384', 'ES512',
            'RS256', 'RS384', 'RS512',
            'PS256', 'PS384', 'PS512'
        ]
        if self.algorithm not in algorithms:
            raise RuntimeError('Unsupported algorithm')

    async def process_resource(self, req, resp, resource, params):
        if req.path in self.exempt_routes or req.method in self.exempt_methods:
            return

        token = req.headers.get('authorization', '').partition('Bearer ')[2]

        try:
            claims = jwt.decode(token,
                                key=self.secret,
                                algorithms=self.algorithm,
                                issuer=self.issuer,
                                audience=self.audience,
                                leeway=self.leeway)
            # print(claims['sub'])
        except jwt.InvalidTokenError as err:
            raise HTTPUnauthorized()

Thanks for sharing this! This helps a lot

selfhosted?

currently using sass one

currentProject/settings/api

Thanks!

You are welcome

Sorry to bother @Vidski . Im trying to do the same, But also add roles😬. Do you know if it is possible to pass the role to the jwt from supabase? At this moment, i only have the id

No worries. Not that I'm aware of, sorry :/

Thanks!

let me know if the custom data is represented in the JWT 😅

Yep. I’ll try it tomorrow 😬

you can modify raw_app_meta_data and set a custom role in there

I also tried it, and indeed, it works

yeah, you want to update the app_metadata, which is only writeable by admins

Hmm, is this in the gotrue api you posted above?

yes

I was thinking of doing directly an sql like:

update auth.users set raw_app_meta_data = '{"role": "admin"}' where id='11538f33-7f11-4c5a-b9a4-1ec009085d42';

sure, does work too

But i'm not sure how to keep the content of raw_app_meta_data, and only add the role at the end

update auth.users set raw_app_meta_data ->> 'role' = 'admin' where id ='XXXX'; should do the trick

there is an operator "->>" ?

yes, these are used for jsonb columns

Hmm.Tried it but it gives syntax error at or near "->>"

https://aaronbos.dev/posts/update-json-postgresql npnp

If somebody else needs it, i managed to do it with:

sql
UPDATE auth.users
SET raw_app_meta_data = jsonb_set(raw_app_meta_data, '{role}', to_json('USER'::text)::jsonb) where id='f2bf56a2-0398-4891-b860-a7bc757ac656';