Ihuku
Ukuvikela iphrojekthi ye-Supabase kudinga indlela enezendlalelo eziningi egxile ekuphathweni kokhiye be-API, ukuphepha kwesizindalwazi, nezimvume zokugcina. I-[S1] Elungiselelwe Ngokungafanele Ukuvikeleka Kwezinga Lomugqa (RLS) noma okhiye abadaluliwe abazwelayo kungaholela ezigamekweni ezibalulekile zokuvezwa kwedatha. [S2] [S3]
Yini eshintshile
Lolu cwaningo luhlanganisa izilawuli zokuphepha eziyinhloko zezindawo ze-Supabase ngokusekelwe kuzinkombandlela ezisemthethweni zezakhiwo. I-[S1] Igxile ekuguqukeni kokusuka ekulungiselelweni kokuthuthukiswa okuzenzakalelayo kuya ekumiseni okuqinile kokukhiqiza, ikakhulukazi mayelana nezindlela zokulawula ukufinyelela. [S2] [S3]
Ubani othintekayo
Izinhlelo zokusebenza ezisebenzisa i-Supabase njenge-Backend-as-a-Service (BaaS) ziyathinteka, ikakhulukazi lezo eziphethe idatha eqondene nomsebenzisi ethile noma izimpahla eziyimfihlo. [S2] Onjiniyela abafaka ukhiye we-service_role kuzinqwaba eziseceleni kweklayenti noma abahluleka ukunika amandla i-RLS basengozini enkulu. [S1]
Isebenza kanjani inkinga
I-Supabase isebenzisa i-PostgreSQL's Row Level Security ukuze ikhawulele ukufinyelela kwedatha. [S2] Ngokuzenzakalelayo, uma i-RLS ivuliwe etafuleni, noma yimuphi umsebenzisi onokhiye we-anon—okuvame ukuba sesidlangalaleni—angafinyelela wonke amarekhodi. I-[S1] Ngokufanayo, i-Supabase Isitoreji sidinga izinqubomgomo ezicacile ukuze zichaze ukuthi yibaphi abasebenzisi noma izindima ezingenza imisebenzi kumabhakede wefayela. [S3]
Lokho okutholayo umhlaseli
Umhlaseli onokhiye osesidlangalaleni we-API angasebenzisa amathebula angekho RLS ukuze afunde, alungise, noma asuse idatha yabanye abasebenzisi. [S1] [S2] Ukufinyelela okungagunyaziwe kumabhakede okugcina kungaholela ekuchaweni kwamafayela omsebenzisi oyimfihlo noma ukususwa kwezimpahla zohlelo lokusebenza ezibalulekile. [S3]
I-FixVibe iyihlolela kanjani
I-FixVibe manje ihlanganisa lokhu njengengxenye yokuhlolwa kwayo kwe-Supabase. I-baas.supabase-security-checklist-backfill ibuyekeza Supabase Imethadatha yebhakede lesitoreji, ukuchayeka kohlu lwento ngokungaziwa, ukuqanjwa kwebhakede okubucayi, namasiginali weSitoreji angabophekile ukusuka emngceleni we-non-public. Amasheke abukhoma ahlobene ahlola ukuchayeka kokhiye wendima yesevisi, Supabase REST/RLS ukuma, kanye nokufuduka kwekhosombe kwe-SQL kokushoda kwe-RLS.
Okufanele ukulungise
Hlala unika amandla Ukuvikeleka Kwezinga Lomugqa kumathebula esizindalwazi futhi usebenzise izinqubomgomo zegranular zabasebenzisi abaqinisekisiwe. [S2] Qinisekisa ukuthi ukhiye othi 'anon' kuphela osetshenziswa kukhodi yohlangothi lweklayenti, kuyilapho ukhiye othi 'service_role' uhlala kuseva. [S1] Lungiselela Ukulawulwa Kokufinyelela Kwesitoreji ukuze uqinisekise ukuthi amabhakede efayela ayimfihlo ngokuzenzakalelayo futhi ukufinyelela kunikezwa kuphela ngezinqubomgomo zokuphepha ezichaziwe. [S3]