Security · High impactFan score 65 · Tier A
Supabase raw_user_meta_data: how a sign-up became Owner
DEV · By Denys Zaichenko ·
The Brief
- raw_user_meta_data holds whatever the browser passes to supabase.auth.signUp().
- On one production app, the handle_new_user trigger read the new user's role from that metadata, so anyone could sign up with the Owner role id.
- The described fix takes the role from a table instead of user metadata.
Why it matters
Any Supabase app that trusts client-supplied sign-up metadata for authorization can let attackers choose their own privileges at registration.
Who’s affected
- Supabase teams using auth triggers that read raw_user_meta_data
What to do
- Stop reading roles from raw_user_meta_data and look up the role from a server-controlled table in handle_new_user
- #supabase
- #authentication
- #authorization
- #security
- #postgres
TL;DR. raw_user_meta_data holds whatever the browser passed to supabase.auth.signUp() . On one production app the handle_new_user trigger read the new user's role from it, so anyone could sign up with the Owner role id and own the account. The fix is to take the role from a table…