Description

Ensure every Edge Function checks that the caller is authorized before it does any work. Either the platform JWT check (Enforce JWT Verification) must be enabled, or the function code must verify the user's token itself, for example with supabase.auth.getClaims(). Only intentionally public functions, such as webhooks, may skip this, and they must use their own checks such as a webhook signature.

Rationale

When a function has no JWT check and no authorization in its code, anyone on the internet can call it without signing in. If the function reads data, sends emails, or uses secret keys, an attacker could misuse it freely. Supabase now recommends verifying auth inside the function when using the new signing keys, so each function must be reviewed to make sure one of these checks is always in place.

Impact

  • Unauthorized requests are rejected

  • Reduces misuse of functions that use secrets

  • Public functions such as webhooks need their own checks

Default Value

By default, Enforce JWT Verification (verify_jwt) is enabled for Edge Functions. It can be turned off in the function's Details tab, in config.toml, or with the --no-verify-jwt deploy flag.

Pre-Requisites

  • Project Owner, Admin, or Developer role

  • A list of functions that are intentionally public

  • Access to each function's source code

Test Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Edge Functions in the sidebar and select each function.

  4. Open the Details tab and check whether Enforce JWT Verification is enabled.

  5. If it is disabled, review the function code and confirm that it verifies the caller (for example, with supabase.auth.getClaims() or a webhook signature check).

  6. If JWT verification is disabled and the code has no authorization check, follow the implementation steps.

Implementation Steps

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Edge Functions in the sidebar and select the function.

  4. Open the Details tab, enable Enforce JWT Verification, and save.

  5. To keep the setting on future deploys, set verify_jwt = true under [functions.<function-name>] in supabase/config.toml.

  6. If the function must stay public or uses the new API keys, keep verification off but add an authorization check in the function code.

Backout Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Edge Functions in the sidebar and select the function.

  4. Open the Details tab, disable Enforce JWT Verification, and save.

  5. Set verify_jwt = false in supabase/config.toml so the next deploy keeps the setting.

Reference