FixVibe
Covered by FixVibehigh

Nweta data enwetaghị ikike site na nchekwa Supabase na-efunahụ ọkwa ọkwa (RLS)

N'ime ngwa ndị Supabase kwadoro, nchekwa data na-adabere na nchekwa ọkwa ọkwa (RLS). Ọ bụrụ na enyereghị RLS aka ma hazie ya na iwu, onye ọrụ ọ bụla nwere igodo amaghị aha ọha nwere ike ịgụ, melite ma ọ bụ hichapụ data n'ofe nchekwa data niile. Nke a dị oke egwu na gburugburu Next.js ebe a na-ejikarị igodo API malite onye ahịa Supabase.

CWE-284

Mmetụta

Ọdịda iji mejuputa Nchekwa Ọkwa Ahịrị (RLS) na-enye ohere ka ndị na-awakpo akwadoghị ịjụ data sitere na nchekwa data Supabase mgbe ekpughere tebụl ọha site na oke [S1]. N'ihi na ngwa Next.js na-ekpughekarị Supabase anon igodo n'akụkụ ndị ahịa, onye na-awakpo nwere ike iji igodo a mee oku REST API ozugbo na ngwa nchekwa data echere, wee nweta ozi nwere mmetụta. [S2].

Ihe kpatara ya

Site na ndabara, tebụl Postgres dị na Supabase chọrọ ịgbalite ọkwa ọkwa nchekwa nke ọma iji gbochie ohere ọha [S1]. Mgbe onye nrụpụta mepụtara tebụl mana chefuo inye aka RLS ma ọ bụ na-akọwaghị amụma mgbochi, nchekwa data nwere ike ikpughe data nye onye ọ bụla nwere igodo anon [S1]. N'ime ngwa Next.js, ntụgharị n'akụkụ ihe nkesa na ị nweta n'akụkụ ndị ahịa na-achọkwa ịkpachara anya ntọlite ​​ndị ahịa Supabase ka ọnọdụ onye ọrụ akwadoro rute na oyi akwa nchekwa data [S2].

Concrete ndozi

  • Kwado RLS: Mee ALTER TABLE "your_table_name" ENABLE ROW LEVEL SECURITY; maka tebụl ọha ọ bụla na-echekwa data ngwa [S1].
  • Kọwaa amụma: Mepụta atumatu akọwapụtara nke na-egbochi ohere dabere na ọkwa njirimara onye ọrụ, dịka CREATE POLICY "Users can see their own data" ON your_table_name FOR SELECT USING (auth.uid() = user_id); [S1].
  • Ndị ahịa n'akụkụ nkesa: Mgbe ị na-eji Next.js, debe ihe nkesa ndị ahịa ọrụ naanị ma ka na-etinye nzacha nwe tupu iweghachite data na ndị ọrụ [S2].

Kedu ka FixVibe si nwalee ya

FixVibe na-agba ọsọ naanị ọgụgụ Supabase RLS nlele site na baas.supabase-rls. Ihe nyocha ahụ na-achọpụta Supabase URL oru ngo yana igodo ọhaneze sitere na ngwugwu Javascript sitere na otu, jụrụ PostgREST maka metadata tebụl ọha, ma nwaa mmachi ịgụ naanị họrọ iji gosi ma ekpughere data na-enweghị nnọkọ onye ọrụ. Ọ naghị fanye, melite, ihichapụ, ma ọ bụ jiri nzere ọrụ-ọrụ. Nyochaa Repo nwekwara ike ijide nke a na mbụ site na repo.supabase.missing-rls, nke na-egosi mbugharị SQL na-emepụta tebụl ọha na-enweghị ENABLE ROW LEVEL SECURITY.