Is it possible to make requests "as" a particular user on the server?

[churichard]

For context, I'm using Next.js with supabase-js, roughly following the Next.js with supabase auth example.

I have a policy uid() = user_id on a table with row level security turned on, and I want it to work nicely with requests happening on the server side as well. Right now what happens is that requests on the server side fail because I'm using supabase-js with the anon key, and the server doesn't "know" what user is logged in.

I know it'll work if I use the service_role key, but I don't want to do that. My logic is in getServerSideProps and it would be very easy for someone to accidentally use the service_role key to make requests on the client side.

So, my question is: is it possible to "force" supabase-js to make requests as a certain user on the server? I can already get the user from the cookie using supabase.auth.api.getUserByCookie - can I somehow pass this into the supabase-js client so that it makes requests as that user?

[atnegrete]

Check out #1067

Can the access token be used on the server? I'm curious, following this too

[churichard]

Yeah, I saw that thread, but my question is a bit different.

In my case, I already know who the user is, and I just simply want to make the request as if I'm the user.

I noticed this line in the Authentication docs:

If no Authorization header is included, the API will assume that you are making a request with an anonymous user.

If an Authorization header is included, the API will "switch" to the role of the user making the request. See the User Management section for more details.

So it seems like I just need to include the Authorization header with the user access token. I can probably do this with a REST API call, but it would be nice if I could also do it using supabase-js as well.

[atnegrete]

@churichard It looks like the issue may be here:
https://github.com/supabase/postgrest-js/blob/7be73b7d2584ebe2725014a42050169f5bb0a62a/src/PostgrestClient.ts#L41

I suppose you could create a new postgrest client, and set the auth token there manually? I'm still getting familiarized with the source code though

[inian]

Hi @churichard, yes you can do that. You need to generate a JWT with the sub claim as the user id and sign the JWT with your JWT secret of your project. Then you can pass that jwt into supabase-js like this.

const supabase = createClient(supabaseUrl, supabaseKey, {
  headers: {
    apiKey: anonKey,
    Authorisation: `Bearer ${jwt}`
  }
});

[elanzini]

Might be a silly question but I could not find the answer here or #6723. How do you get the jwt on the client side?

Is it the access_token inside local storage?

[csalmeida]

Hi all,

I am trying to run a script that inserts a bunch of records into multiple tables programmatically but requires a user to be authenticated in some cases for all triggers to run correctly.

I think the setAuth method is no longer available to authenticate the request in a Node script.
Any thoughts on how to authenticate a user in a script would be very helpful! 🙏

[bombillazo]

Hey @csalmeida so far the solution we have is to create a supabase client instance and pass the Authorization header to the client using option.global.headers

[Jonatthu]

@bombillazo I did exactly that but still const session = await ctx.supabase.auth.getSession(); return null

[pierroo]

I'm a bit late but since this issue is still valid:
What about this "Creating a Supabase client on every request doesn't sound very efficient"?
Would there be any issue having to re-create the client each time?
did you get an answer to that @lintonye ?

[Abhimanyu08]

If using typescript you'll also need to set token_type and user on the object returned by supabase.auth.session:

export const getServerSideProps: GetServerSideProps = async (context) => {

	const { user } = await supabase.auth.api.getUserByCookie(context.req);
	supabase.auth.session = () => ({
		access_token: context.req.cookies["sb-access-token"] as string,
		token_type: "bearer",
		user,
	});

       return {
           props: {posts: supabase.from('posts').select()}
   } 

[bennettdams]

Follow up for Supabase JS v2

You can now easily do this via the new createServerSupabaseClient API. It can either be used in getServerSideProps or in an API endpoint. With that client, you can do things on behalf of the user (like using the storage or getting his authentication).

Here's an example:

// Create authenticated Supabase Client
const supabase = createServerSupabaseClient(ctx);

// Check if we have a session
const {
  data: { session },
} = await supabase.auth.getSession();

I've built myself a helper that I now use everywhere:

export async function getUserFromRequest(
  req: NextApiRequest,
  res: NextApiResponse
): Promise<
  | {
      userId: string;
      error: null;
    }
  | {
      userId: null;
      error: Error;
    }
> {
  const supabaseServerClient = createSupabaseClientFromRequest(req, res);

  const userResult = await supabaseServerClient.auth.getUser();

  if (userResult.error || !userResult) {
    const msg = "Error while getting user.";
    console.error(msg, userResult.error);

    return {
      userId: null,
      error: new Error(`${msg} ${userResult.error.message}`),
    };
  } else {
    return { userId: userResult.data.user.id, error: null };
  }
}

[lgtoledo]

Can you give us github repo with the details of a working example please? Thank you in advance! (the function you've built)

[farzd]

what is createSupabaseClientFromRequest ?

[juanbercoff]

Another options is to modify the headers in the middleware and set the user-id, or access token as a new header and then consume it on your api endpoint.

export async function middleware(req: NextRequest) {
	const res = NextResponse.next();

	const supabase = createMiddlewareSupabaseClient({ req, res });

	const {
		data: { session },
	} = await supabase.auth.getSession();

	if (session) {
		const requestHeaders = new Headers(req.headers);
		requestHeaders.set('user-id', session.user.id);
		const response = NextResponse.next({
			request: {
				// New request headers
				headers: requestHeaders,
			},
		});
		return response;
	}

Either way, the approach of @bennettdams is preferred. It's in the documentation, and you don't have to type the headers.
https://supabase.com/docs/guides/auth/auth-helpers/nextjs

[juanbercoff]

You could also create a branded type to narrow the return value from getUserFromRequest.

type ValidUser = {
	userId: string;
	error: null;
};

type InvalidUser = {
	userId: null;
	error: Error;
};

export function isValidUser(
	userResponse: ValidUser | InvalidUser
): userResponse is ValidUser {
	return !userResponse.error; //or return true;
}

[geoffreygarrett]

This is definitely not something written with posterity on the horizon.