Invoking Edge Functions from client in Supabase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What is the expected response when calling a Supabase Edge Function without authentication?

You have an Edge Function deployed on Supabase that requires user authentication. What will happen if a client calls this function without providing any authentication token?

A The function returns a 404 Not Found error.

B The function executes normally and returns the expected data.

C The function returns a 500 Internal Server Error.

D The function returns a 401 Unauthorized error response.

💡 Hint

Think about what happens when a protected resource is accessed without credentials.

Edge Functions that require authentication will reject requests without valid tokens, returning a 401 Unauthorized error to indicate the client must authenticate.

❓ Configuration

intermediate

Which client code correctly calls a Supabase Edge Function named 'hello' with a JSON body?

You want to call an Edge Function named hello from your client app using Supabase's JavaScript client. Which code snippet correctly sends a POST request with a JSON body {"name": "Alice"}?

A const { data, error } = await supabase.functions.invoke('hello', { method: 'POST', body: { name: 'Alice' } });

B const { data, error } = await supabase.functions.invoke('hello', { method: 'POST', body: JSON.stringify({ name: 'Alice' }) });

C const { data, error } = await supabase.functions.invoke('hello', { body: JSON.stringify({ name: 'Alice' }) });

D const { data, error } = await supabase.functions.invoke('hello', { method: 'GET', body: JSON.stringify({ name: 'Alice' }) });

💡 Hint

Remember to specify the HTTP method and convert the body to a string.

The invoke method requires the HTTP method to be set to POST when sending a body, and the body must be a JSON string.

❓ Architecture

advanced

What is the best way to secure sensitive data when invoking Supabase Edge Functions from a public client?

You have an Edge Function that accesses sensitive data. Your client app is public and runs in users' browsers. How should you protect the sensitive data when invoking the Edge Function?

A Embed the sensitive data directly in the client code and send it with the request.

B Make the Edge Function public and rely on client-side validation to protect data.

C Require authentication and verify user identity inside the Edge Function before returning sensitive data.

D Use a secret API key hardcoded in the client to authenticate requests to the Edge Function.

💡 Hint

Think about where sensitive data should be checked and who should have access.

Authentication and authorization should be enforced server-side in the Edge Function to ensure only authorized users access sensitive data. Client-side secrets can be exposed and are not secure.

🧠 Conceptual

advanced

What happens if a Supabase Edge Function takes longer than 10 seconds to respond when invoked from the client?

Supabase Edge Functions have a maximum execution time limit. What is the expected behavior if a function exceeds this limit when called from a client?

A The function is terminated and the client receives a timeout error response.

B The function continues running in the background and the client receives a success response.

C The function retries automatically until it completes successfully.

D The client waits indefinitely until the function finishes.

💡 Hint

Consider what happens when a serverless function exceeds its time limit.

Supabase Edge Functions have a hard timeout (usually 10 seconds). If exceeded, the function is stopped and the client receives a timeout error.

❓ security

expert

Which option correctly prevents Cross-Site Request Forgery (CSRF) attacks when invoking Supabase Edge Functions from a browser client?

You want to protect your Supabase Edge Functions from CSRF attacks when called from a browser. Which approach is the most effective?

A Use HTTP-only cookies for authentication and validate CSRF tokens in the Edge Function.

B Rely on CORS settings alone to block unauthorized domains.

C Include a secret API key in the client JavaScript code and check it in the Edge Function.

D Disable authentication on the Edge Function to avoid token issues.

💡 Hint

Think about how CSRF tokens and cookies work together to prevent attacks.

Using HTTP-only cookies with CSRF tokens validated server-side is a standard and effective way to prevent CSRF attacks. CORS alone does not prevent CSRF.