kevinzunigacuellar / astro-supabase

Astro and Supabase auth and database demo

Welcome to my GitHub

Let's connect: Twitter • Website • LinkedIn

astro-supabase's Issues

Refreshing dashboard after first google sign in redirects to sign in page

Protected Routes

Protected routes in middleware.ts will fail to identify the protected route if the protected route has a trailing "/" such as "/dashboard/"

In short:

if (protectedRoutes.includes(url.pathname)) will return true for "/dashboard" , but false for "/dashboard/", thus allowing access to the protected route.

You can either add both "/dashboard" and "/dashboard/" to your protected routes array, or add some code to remove all "/" from url.pathname, and then just put "dashboard" in your protected routes array.

This would work with the requested path being either /dashboard or /dashboard/

// remove the slash in the protected route array

const protectedRoutes = ["dashboard"];

// add .split with the .join to the url.pathname to remove all slashes from the url.pathname

if (protectedRoutes.includes(url.pathname.split('/').join("")))

Guestbook post results in 500 Server Error - was missing guestbook SQL.

CREATE TABLE guestbook (
    id SERIAL PRIMARY KEY,
    name TEXT NOT NULL,
    message TEXT NOT NULL,
    created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP
);

I'm guessing this is what's needed?!

It's working fine now ;)

Password Reset Flow

Hi,
Sorry for bugging you. I went through your repo and it is soo clean and clear. This is the simplest and robust authentication with Supabase and Astro.
I want your opinion on how to implement Password reset flow for the user. I currently use this feature but it doesn't look clean in my code. If possible you can implement the password reset feature to your repo.
I am looking at something like the way it is described in supabase docs.
User forgot password

I would be very grateful to you if you could do this. Anyway thanks for your current repo, it helped me a lot.

Thank you.

GET and POST on /api/guestbook are working without being logged in

Hello 👋

First, thank you for this repo!

I found a vulnerability for the /api/guestbook endpoint, we don't need to be logged in to add or read guestbooks.

How to reproduce?

Sign out from the dashboard, open the dev console and past this.

await fetch("https://astro-supabase-auth.vercel.app/api/guestbook", {
    method: "POST",
    body: '{"name":"it","message":"works"}'
})

How to fix?

I think if you had some logic to retrieve the current session and user here 👍
We have the cookies sent in the headers, we can use them I think