Description

Ensure CAPTCHA protection is enabled for the project using hCaptcha or Cloudflare Turnstile, so that the sign-up, sign-in, and password reset endpoints require a valid CAPTCHA token. The application's forms must include the CAPTCHA widget and send its token to Supabase Auth.

Rationale

Automated bots can create large numbers of fake accounts, try many passwords against real accounts, or flood users with password reset emails. CAPTCHA makes these attacks much harder because each request must include a token that proves a human completed the check. This protects both the application and its users from automated abuse.

Impact

  • Blocks most automated sign-up and login attacks

  • Reduces fake accounts and email abuse

  • The application must add the CAPTCHA widget to its forms

Default Value

By default, CAPTCHA protection is disabled.

Pre-Requisites

  • Project Owner or Admin role

  • An hCaptcha or Cloudflare Turnstile account with a site key and secret key

  • Application changes to add the CAPTCHA widget

Test Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Authentication in the sidebar and select Attack Protection.

  4. Verify that Enable CAPTCHA protection is turned on.

  5. If it is off, follow the implementation steps.

Implementation Steps

  1. Add the CAPTCHA widget to the application's sign-up, sign-in, and password reset forms, and pass the token to Supabase Auth.

  2. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  3. Select your project.

  4. Open Authentication in the sidebar and select Attack Protection.

  5. Turn on Enable CAPTCHA protection.

  6. Select your CAPTCHA provider and enter the secret key.

  7. Select Save.

Backout Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Authentication in the sidebar and select Attack Protection.

  4. Turn off Enable CAPTCHA protection.

  5. Select Save.

Reference