Secure Supabase Role Management: Preventing Client-Side Privilege Escalation via user_metadata

Workflow value: 85/100
Status: active · Freshness: 70/100 · Confidence: 0.95 · Level: intermediate
Categories: Quality Control, Token Saving, Context & Memory, Debugging, Shipping
Original source: r/ClaudeCode post/comment

What problem this solves

Preventing client-side privilege escalation in Supabase by avoiding the use of mutable user_metadata for sensitive role claims in JWTs.

Summary

This workflow identifies a common security vulnerability in Supabase where client-writable user_metadata can be used to inject false role claims into JWTs, leading to privilege escalation. It provides two secure patterns to mitigate this: using app_metadata (service-role-only writable) or checking roles against a separate RLS-protected profiles table.

Why it is useful

This workflow is highly valuable because it identifies a critical and subtle security vulnerability in Supabase authentication that can lead to client-side privilege escalation. It provides concrete, repeatable, and secure patterns (app_metadata or RLS with a profiles table) to mitigate this risk, which is essential for building robust and safe applications. The vulnerability is easy to miss, making this guidance crucial for developers.

Workflow

1. Understand that user_metadata in Supabase is client-writable and its data flows into JWT claims on token refresh.
2. Recognize that this allows authenticated users to potentially modify their own roles (e.g., to 'admin') if roles are derived from user_metadata.
3. Avoid using user_metadata for storing sensitive role information or any data that should not be client-modifiable.
4. Implement role management using app_metadata instead, which is write-protected and only modifiable by the service role.
5. Alternatively, implement a separate profiles table with Row Level Security (RLS) to manage and check user roles, ensuring roles are validated against a trusted source rather than mutable JWT claims.

Tools / artifacts

• Supabase
• JWT (JSON Web Token)
• user_metadata
• app_metadata
• auth.users table
• raw_user_meta_data
• profiles table
• Row Level Security (RLS)
• Supabase service role

Validation signals

• Author states "I found out the safe pattern is..."
• Highlights that the vulnerable pattern "passes code review easily", indicating a subtle but real issue.

Limitations

• Low community engagement on this specific comment.
• The original post title suggests Claude Code writes the insecure pattern, but the comment provides a solution/correction rather than a Claude Code generation workflow itself. However, it's a valuable workflow for developers using Supabase, potentially with Claude Code.

Rate this workflow

Upvote this post if the workflow is useful, reproducible, or worth recommending.

Downvote if it is vague, outdated, unsafe, overhyped, or not reproducible.

Reply if it worked for you, failed, is outdated, or has a better alternative.

---

This post was generated automatically from the workflow library database.