Description
Ensure the Allow anonymous sign-ins setting is disabled unless the application has a clear, documented need for anonymous users, such as guest shopping carts. If it is enabled, RLS policies must check the is_anonymous claim to limit what anonymous users can do.
Rationale
Anonymous users are given the authenticated role, the same as real signed-in users. Existing RLS policies written for authenticated users will therefore also apply to anonymous users, who may gain access to data or actions they should not have. Anonymous sign-ins can also be abused to create large numbers of accounts and increase costs.
Impact
Prevents unintended access by anonymous users
Reduces abuse through mass account creation
Guest features that rely on anonymous users will stop working
Default Value
By default, anonymous sign-ins are disabled.
Pre-Requisites
Project Owner or Admin role
Test Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar and select Sign In / Providers.
Verify that Allow anonymous sign-ins is disabled.
If it is enabled without a documented need, follow the implementation steps.
Implementation Steps
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar and select Sign In / Providers.
Disable Allow anonymous sign-ins.
Select Save.
Backout Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar and select Sign In / Providers.
Enable Allow anonymous sign-ins.
Select Save.
Reference