Protected routes in frontend in Supabase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does Supabase handle user session persistence?

Supabase provides a way to keep users logged in across page reloads. What is the main mechanism Supabase uses to persist user sessions in the frontend?

A Supabase requires the developer to manually save the session token in cookies.

B Supabase uses URL query parameters to keep the session active.

C Supabase does not support session persistence; users must log in every time.

D Supabase stores the session token in local storage and automatically refreshes it when needed.

💡 Hint

Think about where browsers commonly store data that survives page reloads.

Supabase automatically stores the session token in local storage, allowing the user to stay logged in even after refreshing the page. This is handled internally by the Supabase client.

❓ Architecture

intermediate

Which frontend route protection method is best with Supabase?

You want to protect a frontend route so only logged-in users can access it. Which approach works best with Supabase's client library?

A Check if <code>supabase.auth.getSession()</code> returns a valid session before rendering the route.

B Hide the route link in the navigation but allow direct URL access.

C Use server-side rendering to check the session token in cookies before sending the page.

D Always render the route and redirect users to login only after they try to access protected data.

💡 Hint

Think about how to verify user login status before showing protected content.

Using supabase.auth.getSession() lets you check if the user is logged in on the client side before rendering protected routes, preventing unauthorized access.

❓ Configuration

advanced

What is the correct way to redirect unauthenticated users in a React app using Supabase?

In a React app using Supabase, you want to redirect users who are not logged in to the login page when they try to access a protected route. Which code snippet correctly implements this behavior?

Supabase

import { useEffect } from 'react';
import { useRouter } from 'next/router';
import { supabase } from '../utils/supabaseClient';

function ProtectedPage() {
  const router = useRouter();

  useEffect(() => {
    async function checkAuth() {
      const session = await supabase.auth.getSession();
      if (!session.data.session) {
        router.push('/login');
      }
    }
    checkAuth();
  }, []);

  return <div>Protected Content</div>;
}

A Remove the <code>async</code> keyword from <code>checkAuth</code> to avoid errors.

B Change <code>router.push('/login')</code> to <code>window.location.href = '/login'</code> for better routing.

C Replace <code>if (!session)</code> with <code>if (!session.data.session)</code> to correctly check the session object.

D Call <code>checkAuth()</code> outside of <code>useEffect</code> to run it immediately.

💡 Hint

Check the structure of the object returned by supabase.auth.getSession().

The getSession() method returns an object with a data property containing the session. So you must check session.data.session to see if a user is logged in.

❓ security

advanced

What security risk exists if protected routes rely only on frontend checks with Supabase?

If you protect routes only by checking user login status on the frontend with Supabase, what is the main security risk?

A Users can bypass frontend checks by disabling JavaScript or modifying client code, gaining unauthorized access to data.

B Supabase will automatically block unauthorized API calls, so there is no risk.

C Frontend checks slow down the app and cause session timeouts.

D There is no risk because Supabase encrypts all frontend data.

💡 Hint

Think about what users can do with their browsers and client code.

Frontend checks can be bypassed by users who disable JavaScript or modify the code, so backend security rules and API protections are necessary to truly secure data.

🧠 Conceptual

expert

How does Supabase's real-time subscription affect protected routes in frontend apps?

Supabase supports real-time data subscriptions. When using protected routes, what must you ensure about these subscriptions to maintain security?

A Disable real-time subscriptions on protected routes to avoid security risks.

B Ensure subscriptions are only established after confirming the user session is valid to prevent unauthorized data streaming.

C Use public subscriptions for all users and filter data on the client side to improve performance.

D Subscriptions automatically respect frontend route protection, so no extra checks are needed.

💡 Hint

Consider when and how subscriptions connect to the backend.

Real-time subscriptions should only start after verifying the user is authenticated, otherwise unauthorized users might receive sensitive data streams.