# Ensure Site URL and redirect URLs are restricted to trusted domains

- Source: https://support.icompaas.com/support/solutions/articles/a_1790103908225376-ensure-site-url-and-redirect-urls-are-restricted-to-trusted-domains
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Supabase cloud](https://support.icompaas.com/support/solutions/c_1790103054038308) › [supabase checks](https://support.icompaas.com/support/solutions/folders/f_1790103067540538)
- Last updated: 2026-09-22
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the Site URL is set to the application's production URL and that the Redirect URLs list contains only trusted domains owned by the organization. Broad wildcards, unused development URLs, and localhost entries should be removed from production projects.

**Rationale**

After sign-in, email confirmation, or password reset, Supabase Auth redirects users only to allowed URLs, often including their access token. If the list allows untrusted or overly broad domains, an attacker can craft a link that sends the user's token to a site the attacker controls. Restricting redirect URLs to trusted domains prevents this token theft.

**Impact**

-   Auth redirects only go to trusted domains
    
-   Prevents tokens from being sent to attacker sites
    
-   Old or development URLs will stop working as redirects
    

**Default Value**

By default, the Site URL is set to http://localhost:3000, and the Redirect URLs list is empty.

**Pre-Requisites**

-   Project Owner or Admin role
    
-   A list of the application's trusted URLs
    

**Test Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Authentication in the sidebar and select URL Configuration.
    
4.  Verify that the Site URL is the production URL of your application.
    
5.  Review the Redirect URLs list for untrusted domains, broad wildcards, or localhost entries.
    
6.  If any are found, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Authentication in the sidebar and select URL Configuration.
    
4.  Set the Site URL to your production URL and save.
    
5.  Remove untrusted, unused, or overly broad entries from Redirect URLs.
    
6.  Add only the exact trusted URLs your application needs.
    

**Backout Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Authentication in the sidebar and select URL Configuration.
    
4.  Add back the removed redirect URLs, or restore the previous Site URL, and save.
    

**Reference**

-   [https://supabase.com/docs/guides/auth/redirect-urls](https://supabase.com/docs/guides/auth/redirect-urls)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.