[SOLAR_FIELDS]

I’ve been self hosting it for the past couple of months. It is a really nice product. Allows one to get fully fledged app with backend running extremely quickly, just drop a front end in. There’s still some annoyances with it though - Work still needs to be done to enable backend communication over services using SSL - it’s currently unencrypted by default. I was able to get SSL working with some minor changes to sources and configuration but it really should be encrypted by default.

The defaults don’t seem super sane either, by default an anonymous user can read your entire public database schema via OpenAPI (which is turned on by default as well), including any RPC’s. That alongside the fact that Postgres grants RPC execute to public by default means that if someone isn’t paying attention they can easily expose execute permissions to the outside world on functions in their public schema to unauthenticated users, and tell them exactly what functions are exposed!

The current response from Supabase is to ensure the API gateway you use authenticates users first - which isn’t really a solution IMO, for multiple reasons. I ended up spending some time figuring out how to revoke the appropriate database permissions from the anonymous role in Postgres, but it shouldn’t be like that. Anon role should start with nothing and the end user should very explicitly be turning on what unauthenticated users can access.

[kiwicopple]

> Anon role should start with nothing and the end user should very explicitly be turning on what unauthenticated users can access.

We agree. We're working on a pathway towards this. Under our original designs we matched all defaults to Postgres' defaults, and with any additions the idea was to "stay out of the way" during development. It's become increasingly important for us to design around security. This will definitely mean more difficult development for newbie developers, but it's an important step forward.

> I’ve been self hosting it for the past couple of months. It is a really nice product

Thanks for the kind words! The credit also belongs to the open source tools we leverage - Postgres, PostgREST, GoTrue, Kong

[nicoburns]

> This will definitely mean more difficult development for newbie developers, but it's an important step forward.

Documentation is key here. Default closed policies aren't a problem if customising them is in the getting started guide.