Description

Ensure multi-factor authentication (MFA) is enabled for the application's users, with at least one second factor such as TOTP available. For sensitive data or actions, RLS policies should require an MFA-verified session by checking that the user's aal claim is aal2.

Rationale

Passwords can be stolen through phishing, reuse, or data breaches. MFA adds a second step that an attacker with only the password cannot complete. Offering MFA protects users who choose it, and requiring it through RLS for sensitive data makes sure that data cannot be accessed without a second factor, even if a password is compromised.

Impact

  • Users can protect their accounts with a second factor

  • Sensitive data can require an MFA-verified session

  • Requires application changes to enroll and challenge factors

Default Value

By default, TOTP MFA is enabled on all projects, but it is not required. Applications must add enrollment screens and RLS rules to enforce it.

Pre-Requisites

  • Project Owner or Admin role

  • Application changes to support MFA enrollment and verification

Test Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Authentication in the sidebar and select Multi-Factor.

  4. Verify that at least one MFA method, such as TOTP, is enabled.

  5. Review RLS policies on sensitive tables and check whether they require aal2.

  6. If no MFA method is enabled, or sensitive tables do not require aal2, follow the implementation steps.

Implementation Steps

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Authentication in the sidebar and select Multi-Factor.

  4. Enable TOTP (and other methods if needed) and save.

  5. Add MFA enrollment and verification to the application.

  6. In the SQL Editor, add a restrictive policy on sensitive tables that checks (select auth.jwt()->>'aal') = 'aal2'.

Backout Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Drop the aal2 policy from the affected tables in the SQL Editor.

  4. Open Authentication > Multi-Factor and disable the MFA methods that were added, then save.

Reference