supabase / supabase-py / 41608478304
96%

DEFAULT BRANCH: main
Ran
Jobs 36
Files 167
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 95.378% (+0.03%) from 95.347%
41608478304

push

github

web-flow 
fix(functions): drop the apiKey header on cross host redirects (#1885)

**What this changes**

The functions client stops forwarding the Supabase `apiKey` header when
a response redirects to a different host. A redirect that stays on the
Supabase host is unaffected, and `follow_redirects` stays on, so normal
behavior does not change.

**The problem**

`AsyncFunctionsClient` and `SyncFunctionsClient` create their default
`httpx` client with `follow_redirects=True`, and every request carries
the project `apiKey` header. `httpx` removes the `Authorization` header
when a response redirects away from the origin, but it forwards custom
headers unchanged. So if an invoked edge function responds with a
redirect to another host, `httpx` follows it and sends the `apiKey`
header to that host.

When the SDK is created with the `service_role` key, which is the normal
server side configuration, that key is secret and bypasses Row Level
Security. Forwarding it to a host the project does not control is a
credential disclosure. The trigger is a cross host redirect from an
invoked function, for example an open redirect driven by user input, or
a function authored by a lower trust teammate.

**The fix**

Wrap the default client in a small `httpx` subclass that overrides
`_redirect_headers` to drop the `apiKey` header when the redirect target
host differs from the current host. This mirrors how `httpx` already
treats `Authorization`, and how the other Supabase client libraries
handle redirect headers (see
https://github.com/supabase/supabase-flutter/pull/1895, which strips
credential headers when a redirect leaves the Supabase hosts). A user
supplied `http_client` is left untouched, since its redirect policy is
the caller's to set.

**Tests**

Two tests on the functions client, async and sync:
- a cross host redirect drops both `apiKey` and `Authorization` at the
next hop
- a same host redirect keeps the `apiKey`

**Related**

This is the same class of issue as
https://g... (continued)

12362 of 12961 relevant lines covered (95.38%)

5.91 hits per line

Coverage Regressions

Lines Coverage ∆ File
1
98.96
0.22% src/supabase_functions/_async/functions_client.py
1
98.96
0.22% src/supabase_functions/_sync/functions_client.py
Jobs
ID Job ID Ran Files Coverage
1 run-ubuntu-latest-3.14-functions - 41608478304.1 18
97.53
GitHub Action Run
2 run-ubuntu-latest-3.12-auth - 41608478304.2 57
93.75
GitHub Action Run
3 run-ubuntu-latest-3.9-realtime - 41608478304.3 17
88.81
GitHub Action Run
4 run-ubuntu-latest-3.13-functions - 41608478304.4 18
97.53
GitHub Action Run
5 run-ubuntu-latest-3.11-functions - 41608478304.5 18
97.53
GitHub Action Run
6 run-ubuntu-latest-3.9-supabase - 41608478304.6 20
96.8
GitHub Action Run
7 run-ubuntu-latest-3.10-postgrest - 41608478304.7 39
97.61
GitHub Action Run
8 run-ubuntu-latest-3.10-supabase - 41608478304.8 20
96.86
GitHub Action Run
9 run-ubuntu-latest-3.12-storage - 41608478304.9 40
94.75
GitHub Action Run
10 run-ubuntu-latest-3.11-postgrest - 41608478304.10 39
97.61
GitHub Action Run
11 run-ubuntu-latest-3.14-auth - 41608478304.11 57
93.73
GitHub Action Run
12 run-ubuntu-latest-3.10-realtime - 41608478304.12 17
88.7
GitHub Action Run
13 run-ubuntu-latest-3.13-auth - 41608478304.13 57
93.75
GitHub Action Run
14 run-ubuntu-latest-3.9-storage - 41608478304.14 40
94.82
GitHub Action Run
15 run-ubuntu-latest-3.11-supabase - 41608478304.15 20
96.86
GitHub Action Run
16 run-ubuntu-latest-3.10-storage - 41608478304.16 40
94.75
GitHub Action Run
17 run-ubuntu-latest-3.13-supabase - 41608478304.17 20
96.86
GitHub Action Run
18 run-ubuntu-latest-3.12-supabase - 41608478304.18 20
96.86
GitHub Action Run
19 run-ubuntu-latest-3.9-functions - 41608478304.19 18
97.72
GitHub Action Run
20 run-ubuntu-latest-3.12-functions - 41608478304.20 18
97.53
GitHub Action Run
21 run-ubuntu-latest-3.14-storage - 41608478304.21 40
94.73
GitHub Action Run
22 run-ubuntu-latest-3.10-functions - 41608478304.22 18
97.53
GitHub Action Run
23 run-ubuntu-latest-3.13-postgrest - 41608478304.23 39
97.61
GitHub Action Run
24 run-ubuntu-latest-3.14-realtime - 41608478304.24 17
87.88
GitHub Action Run
25 run-ubuntu-latest-3.12-postgrest - 41608478304.25 39
97.61
GitHub Action Run
26 run-ubuntu-latest-3.13-realtime - 41608478304.26 17
88.7
GitHub Action Run
27 run-ubuntu-latest-3.14-supabase - 41608478304.27 20
96.85
GitHub Action Run
28 run-ubuntu-latest-3.11-realtime - 41608478304.28 17
88.7
GitHub Action Run
29 run-ubuntu-latest-3.12-realtime - 41608478304.29 17
88.7
GitHub Action Run
30 run-ubuntu-latest-3.14-postgrest - 41608478304.30 39
97.6
GitHub Action Run
31 run-ubuntu-latest-3.11-storage - 41608478304.31 40
94.75
GitHub Action Run
32 run-ubuntu-latest-3.13-storage - 41608478304.32 40
94.75
GitHub Action Run
33 run-ubuntu-latest-3.10-auth - 41608478304.33 57
93.71
GitHub Action Run
34 run-ubuntu-latest-3.9-auth - 41608478304.34 57
93.65
GitHub Action Run
35 run-ubuntu-latest-3.11-auth - 41608478304.35 57
93.71
GitHub Action Run
36 run-ubuntu-latest-3.9-postgrest - 41608478304.36 39
97.66
GitHub Action Run
Source Files on build 41608478304