ETA for user-level auth for realtime streams?

[nc]

We have not yet configured user-level security for realtime streams. Until we build a more robust auth system for websockets, you shouldn't use realtime on any client which is exposed to users.

When do you expect support for user-level auth for realtime streams will land?

[kiwicopple]

Hey @nc - sorry I don't have a timeline yet. We're working on moving to Beta, which is mostly stabity, performance, and reliability fixes.

User-level auth for realtime is a large chunk of work, so it will probably be after we move to Beta (start of December).

[emschwartz]

Hi @kiwicopple do you have any updates on this? It's hard to tell from the docs whether realtime subscriptions should or should not be used from the client side.

[soedirgo]

Hey @emschwartz, unfortunately there's no update on this yet - we'll definitely loop back here once there's progress

[BrandiATMuhkuh]

Hi @kiwicopple do you have any update on that? I love supabase, but row level security on realtime is for me the number one feature I need.

[Vinzent03]

@BrandiATMuhkuh iirc he says at the end of this video that it comes in the next launch week in 8 days.

[BrandiATMuhkuh]

Thank you. I have already try it. It's awesome!. Thanks for all that awesome work!

[thebf]

The above notice should be added to the top of github page for realtime, someone could shoot their foot off or worse with this exceptional foot-gun.

JWTs are quite easy to intercept locally when the user has root/ logging is to active in the client application, or on the network when things aren't 100% correctly set up.

With refresh tokens a user could potentially set up a simple application to have a persistent full replication window to the server.

[arcticmatt]

Also interested in this. Realtime updates are a big sell of Firestore, and good support for it would definitely make me more likely to switch.

Second that this should be flagged more prominently in the docs. This example (https://github.com/supabase/realtime/tree/master/examples/next-js) says the following:

This is an example for demo purposes only. There is no auth built into realtime as it is assumed that you will use this behind your own proxy or a internal network.

but it's more of a sidenote.

[w3b6x9]

@nc

When do you expect support for user-level auth for realtime streams will land?

Landed! Every Supabase project now has Realtime RLS. Database changes are now broadcast only to authorized users based on RLS policies.