Supabase Security when fetching Collection

Ask us anything
,
1

Hello, I am building a webapps where I have both a public (non authentificated frontend) and a (secured backend). I am using Supabase with RLS activated and configured.

The question is:

On the public front end, I have a form where I fetch collection (from Supabase) ex: Service Table to show service option in an a selector inputs fields. RLS is activated on that table to let public user read only.

In that same Supabase Service table I have information sensitive that I do not want to show to the public user (ex : the cost, supplier name, etc.)

In the WeWeb, Supabase Plugin, I have configured the collection to fetch only the fields of service id, and service name. Is it the correct way of doing that to protect the other sensitive information from the table to be accessed by anyone?

Should I create a public_service_view with only the desired public information or use Supabase Column Level Security?

Also if I apply a filter on a collection (ex : to show only active service) to public user, is it secured or is there anyway some could alterate the request to Supabase to get acces to more information than what was filtered in the collection ?

Thanks for your help,

2

I’d suggest you use a view or a function, depending on the amount of the data. If it’s only a few rows, you can create a view, and display that on the frontend, without exposing your table directly to people selecting it via REST / console.

I’m not sure about the Supabase’s column level security, but might be a thing also, I yet have to check that out. They state it should be used with very specific cases, and I’m not sure how it will work with RLS, if it will work with RLS.

1 Like