Self-Hosted: User Authentication Context and Auditability in Supabase Studio

[icrc-fdeniger]

Hi Supabase team,

We are using a self-hosted installation of Supabase and have noticed that while we can enforce authentication (e.g., via SSO or MFA) to access Supabase Studio, the Studio interface itself does not appear to maintain or apply the authenticated user’s identity within the UI. For example, even after logging in, Studio seems to operate as if the user is unauthenticated

For compliance and security purposes, we also need to audit actions performed via Studio (e.g., who executed a query, modified a table, or changed a policy). Without the user’s identity being tied to their actions in Studio, it’s challenging to maintain a clear audit trail.

Is there a way to configure Studio to fully respect the authenticated user’s context ?

Are there existing features, extensions, or configurations for self-hosted Supabase that improve auditability for actions performed in Studio, such as logging which user performed specific operations?

Supabase is a powerful tool !
Thanks for your insights.

[aantti]

There's currently no clear path to do that unfortunately. Studio & API in self-hosted Supabase are protected by HTTP basic auth at the API gateway level (currently Kong). We are evaluating various options here, appreciate your patience. If you have any ideas - please share :) Cc @kallebysantos

[icrc-fdeniger]

well understood . Thanks for your feedback.
Maybe a solution would be to not use Studio for this reason but not sure we will be able to fully manage Supabase deployments without the studio

[aantti]

Ideally we'd like to address this properly, but I can't tell you an ETA. I've seen many people using an additional proxy + something like Authelia on top - but that's for the authentication, not authorization / auditing.

I guess, a "poor man" solution would be adding more users to Kong configuration, and tracing the requests from Kong + Studio logs - not sure how far this could go.

As you need a very detailed audit of actions, you might even consider adding it to Studio on your side. Studio is fully open source :)

[aantti]

You can build your own Studio images along the lines of:

docker build . \
  -f apps/studio/Dockerfile \
  --target production \
  -t supabase-studio:local \
  --no-cache

and use your custom supabase-studio:local images in docker-compose.yml