Description
Ensure the Allow manual linking setting is disabled unless the application has a clear need for users to link extra sign-in methods to their account, for example turning an anonymous user into a permanent one. When it is enabled, the linking flow should be reviewed for security.
Rationale
Manual linking lets a signed-in user attach another identity, such as a Google account, to their existing account. If this is enabled without being needed, it adds another path that attackers could abuse to take over accounts or attach identities they control. Keeping it disabled unless required reduces the ways user accounts can be changed.
Impact
Reduces ways an account's identities can be changed
Lowers the risk of account takeover through linking
Features that link identities will stop working
Default Value
By default, manual linking is disabled.
Pre-Requisites
Project Owner or Admin role
Test Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar and select Sign In / Providers.
Verify that Allow manual linking is disabled.
If it is enabled without a documented need, follow the implementation steps.
Implementation Steps
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar and select Sign In / Providers.
Disable Allow manual linking.
Select Save.
Backout Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar and select Sign In / Providers.
Enable Allow manual linking.
Select Save.
Reference