Description
Ensure the Site URL is set to the application's production URL and that the Redirect URLs list contains only trusted domains owned by the organization. Broad wildcards, unused development URLs, and localhost entries should be removed from production projects.
Rationale
After sign-in, email confirmation, or password reset, Supabase Auth redirects users only to allowed URLs, often including their access token. If the list allows untrusted or overly broad domains, an attacker can craft a link that sends the user's token to a site the attacker controls. Restricting redirect URLs to trusted domains prevents this token theft.
Impact
Auth redirects only go to trusted domains
Prevents tokens from being sent to attacker sites
Old or development URLs will stop working as redirects
Default Value
By default, the Site URL is set to http://localhost:3000, and the Redirect URLs list is empty.
Pre-Requisites
Project Owner or Admin role
A list of the application's trusted URLs
Test Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar and select URL Configuration.
Verify that the Site URL is the production URL of your application.
Review the Redirect URLs list for untrusted domains, broad wildcards, or localhost entries.
If any are found, follow the implementation steps.
Implementation Steps
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar and select URL Configuration.
Set the Site URL to your production URL and save.
Remove untrusted, unused, or overly broad entries from Redirect URLs.
Add only the exact trusted URLs your application needs.
Backout Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar and select URL Configuration.
Add back the removed redirect URLs, or restore the previous Site URL, and save.
Reference