Restrict Supabase Sign up to a specific domain

user_5837236 0
Viewed 380

Supabase url and anon tokens are very easy to retrieve from any site using them. This is normally not an issue for interior tables because you can set up RLS to restrict user from viewing/modifying/deleting data on those tables. But I cannot find anywhere that I can lock down the supabase.auth.signUp() function to a specific domain. I need this to restrict someone from stealing my credentials, building a separate site and flooding my users by signing up random users. I have figured out how to restrict sign ups all together but that is not what I am looking for unless I am missing something with moving this functionality to the server and use the service key instead.

What is the best way to restrict signups to my supabse instance to only users on my domain or those that I deem exceptable?

supabase
1 Answers

I found a solution with a trigger.

You need to create a new function:

CREATE FUNCTION
  public.check_user_domain()
  RETURNS TRIGGER AS
  $$
  BEGIN
    IF NEW.email NOT LIKE '%@test.com' THEN
      raise exception 'INCORRECT_DOMAIN';
    END IF;

    RETURN NEW;
  END;
  $$ LANGUAGE plpgsql SECURITY DEFINER;

Create trigger:

CREATE TRIGGER
  check_user_domain_trigger
  before INSERT ON auth.users
  FOR EACH ROW
  EXECUTE PROCEDURE
    public.check_user_domain();

I tested it on my application and it works.

I recorded a short video on Youtube: https://youtu.be/C-HoRO7Wrhg

Hope it can be helpful for you.

user_162133800
Related