5
Enable PKCE flow/code challenge for links generated by auth.admin.generateLink
Source: supabase/supabase#20937 · opened by @lochoangwork
When generating links using the Supabase service key with auth.admin.generateLink, PKCE flow is not used even if you set auth: {flowType: "pkce"} in the client initialization. The returned linked will be a hashed token that does not need to go through the code verifier/challenge step that PKCE uses. Using the non-admin auth functions like auth.resetPasswordForLink *does* use PKCE as indicated by the returned token having pkce attached to it and, more importantly, the browser where you initialized the request getting the PKCE code saved to it as a cookie to do the code challenge/verify. This allows higher security guarantees where the link cannot be used anywhere but the browser where the request was initialized unless the code is also compromised. The links with generateLink I have found are usable in any browser as long as you have the link which is better for convenience, but worse for security. The reason that I'm asking about generateLink instead of the non-ad…
No pledges yet. Be the first to back this.
Comments
Similar requests
Should Supabase make PKCE optional for confidential clients in the OAuth server?
1 vote · 0 comments
Device Authorization Flow
3 votes · 0 comments
Allow magic links directly to website, skipping `[...].supabase.co/auth` (for PKCE)
4 votes · 0 comments
Enhancement: Add API endpoint to query Auth user by email
3 votes · 0 comments
Generated TypeScript Types - Add type safe to Tables
2 votes · 0 comments
No comments yet.