Email/password authentication in Supabase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What happens after a successful email/password sign-up in Supabase?

When a user signs up with email and password using Supabase's authentication, what is the immediate state of the user's session?

A The user must manually log in after sign-up; no session is created automatically.

B The user receives an email with a magic link but no session token is created.

C The user receives a session token and is automatically logged in.

D The user is blocked until an admin approves the account.

💡 Hint

By default, Supabase requires email confirmation before creating a session.

By default, after a successful email/password sign-up, Supabase sends a confirmation email with a magic link, and no session token is created until the user verifies their email.

❓ security

intermediate

Which Supabase setting improves security for email/password sign-in?

To reduce the risk of unauthorized access, which Supabase authentication setting should be enabled for email/password sign-in?

A Disable JWT expiration to keep sessions valid indefinitely.

B Disable password complexity requirements to allow easy passwords.

C Allow anonymous sign-in alongside email/password sign-in.

D Enable email confirmations to require users to verify their email before login.

💡 Hint

Verifying email ownership helps confirm user identity.

Enabling email confirmations ensures users verify their email addresses before they can log in, improving security.

❓ Configuration

advanced

Which Supabase client code snippet correctly signs in a user with email and password?

Choose the code snippet that correctly signs in a user using Supabase's JavaScript client.

Supabase

const supabase = createClient('https://xyzcompany.supabase.co', 'public-anon-key');

A const { data, error } = await supabase.auth.signIn({ email: '[e-mail]', password: 'password123' });

B const { data, error } = await supabase.auth.signInWithPassword({ email: '[e-mail]', password: 'password123' });

C const { data, error } = await supabase.auth.login({ email: '[e-mail]', password: 'password123' });

D const { data, error } = await supabase.auth.signInUser({ email: '[e-mail]', password: 'password123' });

💡 Hint

Check the official method name for email/password sign-in in Supabase JS client.

The correct method is signInWithPassword to sign in users with email and password.

❓ Architecture

advanced

What is the best way to securely store user passwords in Supabase's backend?

Supabase uses PostgreSQL and built-in authentication. How does it handle user password storage securely?

A Passwords are encrypted with a reversible key stored in the client app.

B Passwords are stored in plain text for quick retrieval.

C Passwords are hashed with a strong algorithm and salted before storage in the database.

D Passwords are stored as base64 encoded strings in the database.

💡 Hint

Think about best practices for password storage in any secure system.

Supabase hashes and salts passwords before storing them, preventing exposure of plain text passwords.

✅ Best Practice

expert

How should you handle password reset securely in a Supabase email/password system?

Which approach follows best security practices for password reset flows in Supabase?

A Send a time-limited, single-use password reset link to the user's verified email address.

B Send the user's current password in plain text via email for convenience.

C Allow password reset without email verification to speed up the process.

D Reset the password automatically when the user clicks a link without any token.

💡 Hint

Consider how to prevent unauthorized password changes.

Sending a secure, time-limited, single-use link to the verified email ensures only the rightful user can reset the password.

Practice

1. What is the primary purpose of using signUp in Supabase email/password authentication?

easy

A. To register a new user with email and password

B. To log in an existing user

C. To reset a user's password

D. To delete a user account

Solution

1. Step 1: Understand the function of signUp

   The signUp method is used to create a new user account with an email and password.

2. Step 2: Differentiate from other authentication methods

   Logging in uses signInWithPassword, not signUp. Password reset and deletion are separate actions.

3. Final Answer:

   To register a new user with email and password -> Option A

4. Quick Check:

   signUp = register new user [OK]

Hint: Remember: signUp means create account, not login [OK]

Common Mistakes:

• Confusing signUp with signInWithPassword
• Thinking signUp resets passwords
• Assuming signUp deletes accounts

2. Which of the following is the correct syntax to sign in a user with email and password using Supabase?

easy

A. supabase.auth.login({ email: '[e-mail]', password: 'pass123' })

B. supabase.auth.signInWithPassword({ email: '[e-mail]', password: 'pass123' })

C. supabase.auth.signUp({ email: '[e-mail]', password: 'pass123' })

D. supabase.auth.authenticate({ email: '[e-mail]', password: 'pass123' })

Solution

1. Step 1: Identify the correct method for signing in

   The method to sign in with email and password is signInWithPassword.

2. Step 2: Check the syntax format

   The correct syntax uses an object with email and password keys inside signInWithPassword.

3. Final Answer:

   supabase.auth.signInWithPassword({ email: '[e-mail]', password: 'pass123' }) -> Option B

4. Quick Check:

   signInWithPassword = login syntax [OK]

Hint: signInWithPassword is for login, signUp is for registration [OK]

Common Mistakes:

• Using signUp instead of signInWithPassword to login
• Using non-existent methods like login or authenticate
• Incorrect object structure in method call

3. What will be the result of this code snippet?

const { data, error } = await supabase.auth.signUp({ email: '[e-mail]', password: '123' });
console.log(error ? error.message : 'User created');

medium

A. Password should be at least 6 characters

B. User created

C. Email already exists

D. SyntaxError

Solution

1. Step 1: Analyze the password length

   The password '123' is only 3 characters, which is too short for Supabase's minimum password length (usually 6).

2. Step 2: Understand error handling

   The error object will contain a message about the weak password, so the console logs that message.

3. Final Answer:

   Password should be at least 6 characters -> Option A

4. Quick Check:

   Short password triggers error message [OK]

Hint: Passwords must meet minimum length to avoid errors [OK]

Common Mistakes:

• Assuming user is created with short password
• Ignoring error object and expecting success
• Confusing error messages for duplicate email

4. You wrote this code to sign in a user:

const { data, error } = await supabase.auth.signInWithPassword({ email: '[e-mail]' });

Why does it fail and how to fix it?

medium

A. Use signUp instead of signInWithPassword

B. Email format is wrong; fix the email string

C. Missing password field; add password to the object

D. signInWithPassword requires a callback function

Solution

1. Step 1: Check required parameters for signInWithPassword

   The method requires both email and password fields to authenticate.

2. Step 2: Identify missing password

   The code only provides email, so it fails. Adding password fixes the issue.

3. Final Answer:

   Missing password field; add password to the object -> Option C

4. Quick Check:

   Both email and password needed for signInWithPassword [OK]

Hint: Always provide both email and password to signInWithPassword [OK]

Common Mistakes:

• Omitting password when signing in
• Confusing signUp and signInWithPassword usage
• Thinking signInWithPassword needs a callback

5. You want to create a secure signup flow that prevents duplicate emails and weak passwords. Which approach is best?

hard

A. Call signInWithPassword first, then signUp if login fails

B. Allow signup without email verification to speed up user creation

C. Only check password length on client side, skip server validation

D. Use signUp and check error for duplicates or weak passwords before confirming success

Solution

1. Step 1: Use signUp to register users

   This method handles creating accounts and returns errors for duplicates or weak passwords.

2. Step 2: Check the error object to handle issues

   By checking error, you can inform users about duplicates or weak passwords and prevent bad signups.

3. Final Answer:

   Use signUp and check error for duplicates or weak passwords before confirming success -> Option D

4. Quick Check:

   signUp + error check = secure signup flow [OK]

Hint: Always check errors after signUp to catch duplicates and weak passwords [OK]

Common Mistakes:

• Trying to sign in before signup to check duplicates
• Skipping server-side password validation
• Ignoring email verification importance