Supabase Audit Auth Config

Authentication Configuration Audit

🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED You MUST write to context files AS YOU GO, not just at the end. - Write to .sb-pentest-context.json IMMEDIATELY after each setting analyzed - Log to .sb-pentest-audit.log BEFORE and AFTER each test - DO NOT wait until the skill completes to update files - If the skill crashes or is interrupted, all prior findings must already be saved This is not optional. Failure to write progressively is a critical error.

This skill analyzes the authentication configuration of a Supabase project.

When to Use This Skill

• To review authentication security settings
• Before production deployment
• When auditing auth-related vulnerabilities
• As part of comprehensive security review

Prerequisites

• Supabase URL and anon key available
• Detection completed

Auth Endpoints

Supabase Auth (GoTrue) exposes:

https://[project].supabase.co/auth/v1/

What Can Be Detected

From the public API, we can detect:

Usage

Basic Auth Audit

Audit authentication configuration

Check Specific Features

Check if signup is open and what providers are enabled

Output Format

═══════════════════════════════════════════════════════════
 AUTHENTICATION CONFIGURATION AUDIT
═══════════════════════════════════════════════════════════

 Project: abc123def.supabase.co
 Auth Endpoint: https://abc123def.supabase.co/auth/v1/

 ─────────────────────────────────────────────────────────
 Authentication Methods
 ─────────────────────────────────────────────────────────

 Email/Password: ✅ Enabled
 ├── Signup: ✅ Open (anyone can register)
 ├── Email Confirmation: ❌ NOT REQUIRED ← P1 Issue
 ├── Password Min Length: 6 characters ← P2 Consider longer
 └── Secure Password Check: Unknown

 Phone/SMS: ✅ Enabled
 └── Provider: Twilio

 Magic Link: ✅ Enabled
 └── OTP Expiry: 300 seconds (5 min)

 OAuth Providers Detected: 3
 ├── Google: ✅ Enabled
 ├── GitHub: ✅ Enabled
 └── Discord: ✅ Enabled

 Anonymous Auth: ✅ Enabled ← Review if intended

 ─────────────────────────────────────────────────────────
 Security Settings
 ─────────────────────────────────────────────────────────

 Rate Limiting:
 ├── Signup: 3/hour per IP (good)
 ├── Token: 30/hour per IP (good)
 └── Recovery: 3/hour per IP (good)

 Session Configuration:
 ├── JWT Expiry: 3600 seconds (1 hour)
 ├── Refresh Token Rotation: Unknown
 └── Inactivity Timeout: Unknown

 Security Headers:
 ├── CORS: Configured
 ├── Allowed Origins: * (wildcard) ← P2 Consider restricting
 └── Credentials: Allowed

 ─────────────────────────────────────────────────────────
 Findings
 ─────────────────────────────────────────────────────────

 🟠 P1: Email Confirmation Disabled

 Issue: Users can signup and immediately access the app
        without verifying their email address.

 Risks:
 ├── Fake accounts with invalid emails
 ├── Typosquatting (user@gmial.com)
 ├── No verified communication channel
 └── Potential for abuse

 Recommendation:
 Supabase Dashboard → Authentication → Email Templates
 → Enable "Confirm email"

 ─────────────────────────────────────────────────────────

 🟡 P2: Short Minimum Password Length

 Issue: Minimum password length is 6 characters.

 Recommendation: Increase to 8-12 characters minimum.
 Supabase Dashboard → Authentication → Settings
 → Minimum password length

 ─────────────────────────────────────────────────────────

 🟡 P2: Wildcard CORS Origin

 Issue: CORS allows requests from any origin (*).

 Recommendation: Restrict to your domains only.
 Supabase Dashboard → Authentication → URL Configuration
 → Site URL and Redirect URLs

 ─────────────────────────────────────────────────────────

 ℹ️ INFO: Anonymous Auth Enabled

 Note: Anonymous authentication is enabled.

 This is fine if intentional (guest access).
 Review if you expect all users to be authenticated.

 ─────────────────────────────────────────────────────────
 Summary
 ─────────────────────────────────────────────────────────

 Auth Methods: 5 enabled
 OAuth Providers: 3

 Findings:
 ├── P1 (High): 1 - Email confirmation disabled
 ├── P2 (Medium): 2 - Password length, CORS
 └── Info: 1 - Anonymous auth enabled

 Recommended Actions:
 1. Enable email confirmation
 2. Increase minimum password length
 3. Restrict CORS to specific domains
 4. Review if anonymous auth is needed

═══════════════════════════════════════════════════════════

Security Checklist

Email Authentication

OAuth Configuration

Session Security

Context Output

{
  "auth_config": {
    "timestamp": "2025-01-31T12:30:00Z",
    "methods": {
      "email": {
        "enabled": true,
        "signup_open": true,
        "email_confirmation": false,
        "min_password_length": 6
      },
      "phone": {
        "enabled": true,
        "provider": "twilio"
      },
      "magic_link": {
        "enabled": true,
        "otp_expiry": 300
      },
      "oauth": {
        "enabled": true,
        "providers": ["google", "github", "discord"]
      },
      "anonymous": {
        "enabled": true
      }
    },
    "findings": [
      {
        "severity": "P1",
        "issue": "Email confirmation disabled",
        "recommendation": "Enable email confirmation in dashboard"
      }
    ]
  }
}

Common Auth Vulnerabilities

1. No Email Confirmation

// User can signup with any email
const { data, error } = await supabase.auth.signUp({
  email: 'fake@example.com',  // No verification needed
  password: 'password123'
})
// User is immediately authenticated

2. Weak Password Policy

// Weak password accepted
await supabase.auth.signUp({
  email: 'user@example.com',
  password: '123456'  // Accepted with min length 6
})

3. Open Signup When Not Needed

If your app should only have admin-created users:

-- Disable public signup via dashboard
-- Or use invite-only flow

Remediation Examples

Enable Email Confirmation

1. Supabase Dashboard → Authentication → Email Templates
2. Enable "Confirm email"
3. Customize confirmation email template
4. Handle unconfirmed users in your app

Strengthen Password Requirements

1. Dashboard → Authentication → Settings
2. Set minimum length to 8+
3. Consider enabling password strength checks

Restrict CORS

1. Dashboard → Authentication → URL Configuration
2. Set specific Site URL
3. Add only your domains to Redirect URLs
4. Remove wildcard entries

MANDATORY: Progressive Context File Updates