Your Supabase Storage bucket is public - signed URLs will not save you
Problem You are generating private B2B images with Sharp in a Next.js API route and storing the derivatives in Supabase Storage. The bucket that holds those images is currently public , meaning anyone who can guess or discover the object URL can download the original or any derivative without authentication. This defeats the “private‑only” intent of your workflow and can expose sensitive business…
Supabase Storage buckets can be configured to be public, allowing anyone to access objects directly using a stable URL, bypassing authentication. This can expose sensitive images generated privately using Sharp in Next.js API routes. To prevent this, turn off the public flag by updating the bucket settings, which will require authentication for access.
Implementing row-level security policies to restrict access to only authenticated users and their respective folders ensures that only authorized individuals can view the images. Instead of providing raw object URLs, generate expiring signed URLs server-side using Supabase's `createSignedUrl` method, which adds a time-limited token for validation before serving the object.
This approach safeguards against unauthorized access even if the signed URL is intercepted. By following these steps, the privacy of B2B images can be maintained while still allowing authenticated users to access the necessary resources securely.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
