Verify JWT with legacy secret enabling on all edge function updates

[TrapperBo]

When a new supabase function is created or edited the default behavior seems to be to enable Verify JWT with legacy secret. Supabase recommends that this be OFF with JWT and additional authorization logic implemented inside your function's code. This old legacy way is deprecated.

This is constantly breaking every edge function that is created that is accessed from outside of Supabase and I am having to manually turn this off on all public facing Supabase edge functions after they are updated.

Can you update the system prompt to keep this disabled please? Thank you.

[spaghettibernie]

Having the same issue.
Are we missing something?
But yes, each time I re/deploy an edge function I have to manually set this off.

[TrapperBo]

@wwwillchen this is a huge bug for me causing constant chaos and lost tokens. Can this be prioritized?

[wwwillchen]

@beaugast thanks for raising this, didn't realize supabase now recommends this to be turned off - i'll fix this in next week's beta release.

[TheQuiffs]

I just wanted to say this is still an issue and incredibly complicated to deal with. My whole website sign-up system keeps failing when this turns back on.

[jellederijke]

I experience the same issue. It would be great if this setting was persistent.

[pacnpal]

I don't know if this is a dyad issue as I am not using it and still experiencing the issue. I did write a python script however, that checks and forces every Edge function to disable that function using the Supabase Management API. Until a fix is in place for this issue, I am running this script after every function update to ensure my functions keep that setting disabled.

You need to fill in your environment variables of course, and then just run it. No dependencies needed.

SUPABASE_PROJECT_REF is your Supabase project's unique alphanumeric reference id, easiest way to find it is in any URL for your project.
e.g. https://supabase.com/dashboard/project/xxxxxxxxxxxxxx <-- this last part of the URL after project/ is the id of your project

SUPABASE_ACCESS_TOKEN is a management API key for your Supabase account. You can create one here: https://supabase.com/dashboard/account/tokens

#!/usr/bin/env python3
"""
Script to bulk update all Supabase Edge Functions to disable JWT verification.
Run this on a schedule using cron or a task scheduler.
No external dependencies required - uses only Python standard library.
"""

import os
import sys
import json
from urllib.request import Request, urlopen
from urllib.error import HTTPError, URLError

# Configuration - set these as environment variables
SUPABASE_PROJECT_REF = os.getenv('SUPABASE_PROJECT_REF')
SUPABASE_ACCESS_TOKEN = os.getenv('SUPABASE_ACCESS_TOKEN')
SUPABASE_API_BASE = 'https://api.supabase.com/v1'


def get_all_functions(project_ref, access_token):
    """Fetch all functions for the given project."""
    url = f"{SUPABASE_API_BASE}/projects/{project_ref}/functions"
    
    req = Request(url)
    req.add_header('Authorization', f'Bearer {access_token}')
    req.add_header('Content-Type', 'application/json')
    
    try:
        with urlopen(req) as response:
            data = response.read().decode('utf-8')
            return json.loads(data)
    except HTTPError as e:
        error_body = e.read().decode('utf-8')
        raise Exception(f"HTTP Error {e.code}: {error_body}")


def bulk_update_functions(project_ref, access_token, functions):
    """Bulk update all functions to set verify_jwt to false."""
    url = f"{SUPABASE_API_BASE}/projects/{project_ref}/functions"
    
    # Prepare the update payload - set verify_jwt to false for all functions
    updated_functions = []
    for func in functions:
        updated_func = {
            'id': func['id'],  # ID is required
            'slug': func['slug'],
            'name': func['name'],
            'verify_jwt': False,  # Set to false
            'status': func['status'],
            'version': func['version'],
            'created_at': func['created_at'],
        }
        
        # Include optional fields if they exist and are not null
        optional_fields = ['import_map', 'entrypoint_path', 'import_map_path', 'ezbr_sha256']
        for field in optional_fields:
            if field in func and func[field] is not None:
                updated_func[field] = func[field]
        
        updated_functions.append(updated_func)
    
    # Prepare the request
    data = json.dumps(updated_functions).encode('utf-8')
    
    req = Request(url, data=data, method='PUT')
    req.add_header('Authorization', f'Bearer {access_token}')
    req.add_header('Content-Type', 'application/json')
    
    try:
        with urlopen(req) as response:
            response_data = response.read().decode('utf-8')
            return json.loads(response_data)
    except HTTPError as e:
        error_body = e.read().decode('utf-8')
        raise Exception(f"HTTP Error {e.code}: {error_body}")


def main():
    """Main execution function."""
    # Validate environment variables
    if not SUPABASE_PROJECT_REF:
        print("Error: SUPABASE_PROJECT_REF environment variable not set")
        sys.exit(1)
    
    if not SUPABASE_ACCESS_TOKEN:
        print("Error: SUPABASE_ACCESS_TOKEN environment variable not set")
        sys.exit(1)
    
    try:
        print(f"Fetching functions for project: {SUPABASE_PROJECT_REF}")
        functions = get_all_functions(SUPABASE_PROJECT_REF, SUPABASE_ACCESS_TOKEN)
        
        if not functions:
            print("No functions found in project")
            return
        
        print(f"Found {len(functions)} function(s)")
        
        # Check which functions need updating
        needs_update = [f for f in functions if f.get('verify_jwt') != False]
        
        if not needs_update:
            print("All functions already have verify_jwt set to false")
            return
        
        print(f"Updating {len(needs_update)} function(s) to set verify_jwt=false")
        
        result = bulk_update_functions(SUPABASE_PROJECT_REF, SUPABASE_ACCESS_TOKEN, functions)
        
        print("✓ Successfully updated functions:")
        for func in result.get('functions', []):
            print(f"  - {func['slug']}: verify_jwt={func['verify_jwt']}")
        
    except Exception as e:
        print(f"Error: {e}")
        sys.exit(1)


if __name__ == '__main__':
    main()

[degapps]

Same issue here. Every time I deploy a function/new version of it, the switch turns on and breaks my API.

[mpraski]

Also encountered this problem, it will be cumbersome to deal with and lead to lost data. Could you please prioritize it?

[bieblebrox]

Bumping this to help prioritize the issue.

It's a very uncommon pattern that deploying a function somehow overrides that function's existing settings.

[bieblebrox]

By the way this issue is marked as closed.. it should be wide open