FeatureFuel
5

Enable PKCE flow/code challenge for links generated by auth.admin.generateLink

Source: supabase/supabase#20937 · opened by @lochoangwork
When generating links using the Supabase service key with auth.admin.generateLink, PKCE flow is not used even if you set auth: {flowType: "pkce"} in the client initialization. The returned linked will be a hashed token that does not need to go through the code verifier/challenge step that PKCE uses. Using the non-admin auth functions like auth.resetPasswordForLink *does* use PKCE as indicated by the returned token having pkce attached to it and, more importantly, the browser where you initialized the request getting the PKCE code saved to it as a cookie to do the code challenge/verify. This allows higher security guarantees where the link cannot be used anywhere but the browser where the request was initialized unless the code is also compromised. The links with generateLink I have found are usable in any browser as long as you have the link which is better for convenience, but worse for security. The reason that I'm asking about generateLink instead of the non-ad…

No pledges yet. Be the first to back this.

Make a pledge

Pledge your monetary support if this feature is added.

$

Comments

No comments yet.

Replying to

Add a comment

What do you think about this feature request?


Similar requests