Email/password authentication in Supabase - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is email/password authentication in Supabase?

It is a method where users sign up or log in using their email address and a password. Supabase manages this securely for your app.

intermediate

How does Supabase handle password security?

Supabase stores passwords securely by hashing them, so the actual password is never saved. This protects user data even if the database is accessed.

beginner

What is the purpose of email confirmation in Supabase authentication?

Email confirmation verifies that the user owns the email address they signed up with. It helps prevent fake accounts and improves security.

beginner

Which Supabase function is used to sign up a user with email and password?

The function is `supabase.auth.signUp({ email, password })`. It creates a new user account with the provided credentials.

beginner

What happens if a user tries to log in with the wrong password in Supabase?

Supabase returns an error indicating the credentials are invalid. The user must enter the correct password to access their account.

Which method does Supabase use to protect stored passwords?

A Encrypting passwords with reversible keys

B Storing passwords in plain text

C Hashing passwords

D Sending passwords via email

Supabase hashes passwords so the original password is not stored, enhancing security.

What is the main purpose of email confirmation in authentication?

A To reset the password automatically

B To allow login without password

C To store the password securely

D To verify the user's email ownership

Email confirmation ensures the user owns the email address they registered with.

Which Supabase function signs up a user with email and password?

A supabase.auth.signUp()

B supabase.auth.confirmEmail()

C supabase.auth.resetPassword()

D supabase.auth.signIn()

The signUp() function creates a new user account with email and password.

What does Supabase return if login credentials are incorrect?

A Error indicating invalid credentials

B Success message

C Password reset link

D User profile data

Supabase returns an error to indicate the login failed due to wrong credentials.

Why is it important not to store passwords in plain text?

A It makes passwords easier to remember

B It protects user data if the database is accessed

C It speeds up login time

D It allows password sharing

Storing passwords securely protects users if the database is compromised.

Explain how email/password authentication works in Supabase and why it is secure.

Think about the steps from sign up to login and how security is maintained.

Describe the process and functions used to sign up and log in a user with email and password in Supabase.

Focus on the main Supabase auth functions and their roles.

Practice

1. What is the primary purpose of using signUp in Supabase email/password authentication?

easy

A. To register a new user with email and password

B. To log in an existing user

C. To reset a user's password

D. To delete a user account

Solution

1. Step 1: Understand the function of signUp

   The signUp method is used to create a new user account with an email and password.

2. Step 2: Differentiate from other authentication methods

   Logging in uses signInWithPassword, not signUp. Password reset and deletion are separate actions.

3. Final Answer:

   To register a new user with email and password -> Option A

4. Quick Check:

   signUp = register new user [OK]

Hint: Remember: signUp means create account, not login [OK]

Common Mistakes:

• Confusing signUp with signInWithPassword
• Thinking signUp resets passwords
• Assuming signUp deletes accounts

2. Which of the following is the correct syntax to sign in a user with email and password using Supabase?

easy

A. supabase.auth.login({ email: '[e-mail]', password: 'pass123' })

B. supabase.auth.signInWithPassword({ email: '[e-mail]', password: 'pass123' })

C. supabase.auth.signUp({ email: '[e-mail]', password: 'pass123' })

D. supabase.auth.authenticate({ email: '[e-mail]', password: 'pass123' })

Solution

1. Step 1: Identify the correct method for signing in

   The method to sign in with email and password is signInWithPassword.

2. Step 2: Check the syntax format

   The correct syntax uses an object with email and password keys inside signInWithPassword.

3. Final Answer:

   supabase.auth.signInWithPassword({ email: '[e-mail]', password: 'pass123' }) -> Option B

4. Quick Check:

   signInWithPassword = login syntax [OK]

Hint: signInWithPassword is for login, signUp is for registration [OK]

Common Mistakes:

• Using signUp instead of signInWithPassword to login
• Using non-existent methods like login or authenticate
• Incorrect object structure in method call

3. What will be the result of this code snippet?

const { data, error } = await supabase.auth.signUp({ email: '[e-mail]', password: '123' });
console.log(error ? error.message : 'User created');

medium

A. Password should be at least 6 characters

B. User created

C. Email already exists

D. SyntaxError

Solution

1. Step 1: Analyze the password length

   The password '123' is only 3 characters, which is too short for Supabase's minimum password length (usually 6).

2. Step 2: Understand error handling

   The error object will contain a message about the weak password, so the console logs that message.

3. Final Answer:

   Password should be at least 6 characters -> Option A

4. Quick Check:

   Short password triggers error message [OK]

Hint: Passwords must meet minimum length to avoid errors [OK]

Common Mistakes:

• Assuming user is created with short password
• Ignoring error object and expecting success
• Confusing error messages for duplicate email

4. You wrote this code to sign in a user:

const { data, error } = await supabase.auth.signInWithPassword({ email: '[e-mail]' });

Why does it fail and how to fix it?

medium

A. Use signUp instead of signInWithPassword

B. Email format is wrong; fix the email string

C. Missing password field; add password to the object

D. signInWithPassword requires a callback function

Solution

1. Step 1: Check required parameters for signInWithPassword

   The method requires both email and password fields to authenticate.

2. Step 2: Identify missing password

   The code only provides email, so it fails. Adding password fixes the issue.

3. Final Answer:

   Missing password field; add password to the object -> Option C

4. Quick Check:

   Both email and password needed for signInWithPassword [OK]

Hint: Always provide both email and password to signInWithPassword [OK]

Common Mistakes:

• Omitting password when signing in
• Confusing signUp and signInWithPassword usage
• Thinking signInWithPassword needs a callback

5. You want to create a secure signup flow that prevents duplicate emails and weak passwords. Which approach is best?

hard

A. Call signInWithPassword first, then signUp if login fails

B. Allow signup without email verification to speed up user creation

C. Only check password length on client side, skip server validation

D. Use signUp and check error for duplicates or weak passwords before confirming success

Solution

1. Step 1: Use signUp to register users

   This method handles creating accounts and returns errors for duplicates or weak passwords.

2. Step 2: Check the error object to handle issues

   By checking error, you can inform users about duplicates or weak passwords and prevent bad signups.

3. Final Answer:

   Use signUp and check error for duplicates or weak passwords before confirming success -> Option D

4. Quick Check:

   signUp + error check = secure signup flow [OK]

Hint: Always check errors after signUp to catch duplicates and weak passwords [OK]

Common Mistakes:

• Trying to sign in before signup to check duplicates
• Skipping server-side password validation
• Ignoring email verification importance