Securing API Endpoints with NestJS and Supabase Authentication

Introduction

Maintaining strict control over who can access specific parts of your application is a challenge as it grows. In the vive-tu-mente-preview project, we recently addressed the need to enforce authentication on protected resources, ensuring that only verified users can trigger participation-status actions. By leveraging the integration between NestJS and Supabase, we can create a robust guard mechanism to gate our API endpoints.

The Challenge: Protecting Sensitive Resources

When building a backend with NestJS, you often start with public endpoints, but quickly transition to handling user-specific data. The issue arises when endpoints meant for authenticated users are left "open" or lack proper verification against your authentication provider. Our goal was to ensure that any request impacting a user's participation status is validated against Supabase's identity service before processing.

Implementation Strategy

To secure our routes, we implemented a modular authentication approach. NestJS allows us to encapsulate authentication logic into dedicated guards, which act as a middleware layer between the client and our business logic.

Creating the Guard

By creating a custom guard that intercepts incoming requests, we can verify the user's session token provided by Supabase. If the token is invalid or missing, the guard blocks the request, returning a 401 Unauthorized response.

import { Injectable, CanActivate, ExecutionContext, UnauthorizedException } from '@nestjs/common';
import { supabaseClient } from './supabase-provider';

@Injectable()
export class AuthGuard implements CanActivate {
  async canActivate(context: ExecutionContext): Promise<boolean> {
    const request = context.switchToHttp().getRequest();
    const token = request.headers.authorization?.split(' ')[1];

    if (!token) throw new UnauthorizedException();

    const { data, error } = await supabaseClient.auth.getUser(token);

    if (error || !data.user) {
      throw new UnauthorizedException('Invalid authentication token');
    }

    request.user = data.user;
    return true;
  }
}

Benefits of a Guarded Approach

1. Separation of Concerns: Your main business logic remains "clean" because it doesn't need to manually check authentication status.
2. Consistency: By applying the guard globally or on a per-controller basis, you ensure uniform security across your application.
3. Tight Integration: Using the Supabase client directly within the guard ensures that you are leveraging your existing user management system without extra overhead.

Conclusion

Securing your NestJS API with Supabase is a high-leverage task that prevents unauthorized access to sensitive application states. By abstracting this logic into a reusable guard, you not only improve your security posture but also keep your codebase maintainable. Start by identifying your most sensitive endpoints and applying authentication guards to them today to ensure your application remains secure as it scales.

Generated with Gitvlg.com