Hacker News Reader

Hacker News

Comment by kiwicopple | Hacker News Reader

Full thread

kiwicopple

hey hn, supabase ceo here

this one is really 3 launches for auth:

- SAML 2.0, for developers can add SSO to their own apps

- PKCE: support for Mobile and server-side auth

- Native Apple login on iOS

We’ve been dogfooding SSO already and it stable.

PKCE is going to be rolled out incrementally across the platform - we’ve tried to engineer it so that there are no breaking changes for your applications, but will exercise caution with the deployment.

A lot of companies were blocked by the lack of iOS support - we had a lot of feedback on this one and so we appreciate the patience while we developed it. Native Android support will follow soon.

Some of the Auth team will be in to answer questions on the technical side. This is the second-to-last day of Launch Week - I promise that you’ll be rid of us after a few more releases tomorrow.

View on HN

Can’t tell from (admittedly skimming) the announcement: is SSO charged extra? It says availability on Pro plan but pricing page hasn’t changed it only says social auth

The pricing is listed in the "Single Sign-On (SAML 2.0)" row on the pricing page: https://supabase.com/pricing

It's available on the Pro Tier. You get 50 free users, then $0.015 per additional MAU. We always aim for simple, transparent, and pricing - we're hoping this is a good balance.

And just to be clear, this is for building SSO for your own apps, this is not SSO for the supabase platform (which we're still figuring out pricing for, and yes - we're well aware of the SSO Tax).

Awesome and Awesome!

I'm distinctly looking at it from an application point of view right now, SSO just made Supabase very attractive, as well as the SOC Type 2 certification recently announced (yesterday iirc). These were hurdles for our customers, so I'm checking this out with great interest.

Great job team!

EDIT: With Regards To The SOC Certification a short announcement might be useful for linking purposes.

yes, we now have SOC2 Type2.

It wasn't much of an announcement, just a comment: https://news.ycombinator.com/item?id=35526018

FWIW, the language on your PKCE flow is wrong:

* It's not establishment of a "session", but a token set which you're issuing. * The authorization server will return those tokens after validating the code_verifier.

Also, be careful about PKCE on mobile platforms. Unless you're specifically mapping or restricting redirect_uris to an Android intent, on that platform, you're subject to replay attacks due to some cookie sharing in Chrome.

Supabase Auth Engineer here. You are right that a token set is issued and that the authorization server will return an access_token and a refresh_token after validating the code_verifier we chose the term "session" instead of token set as a token (loosely speaking) maps to a server session and we felt that might be easier to understand for our readers who are coming in without an auth background. Sorry for any confusion caused that might have caused.

Thanks for the heads up about replay attacks - we'll be sure to let the Kotlin/Java library developers know about the potential vulnerabilities that you've mentioned.

Reply on news.ycombinator.com