mirror of
https://github.com/supabase/supabase.git
synced 2026-10-13 05:09:12 +03:00
Danny White
24be387cdb
## What kind of change does this PR introduce? Docs update. Aligns documentation and style guides with the **Sign in / Sign out / Sign up** platform standard. Closes DOCS-1328. Related to [#49874](https://github.com/supabase/supabase/pull/49874). ## What is the current behavior? Docs style guides prefer _login_ / _log in_. Guide prose uses mixed login and sign in wording. ## What is the new behavior? - [WORD_LIST.md](apps/docs/WORD_LIST.md) and [copywriting.mdx](apps/design-system/content/docs/copywriting.mdx) document the sign in standard - Design-system auth examples updated - Guide prose and API reference spec descriptions updated ### Terminology **Standard:** Use _sign in_, _sign out_, and _sign up_ as verbs. Use _sign-in_, _sign-out_, and _sign-up_ as nouns and adjectives. Match Studio UI labels (**Sign in**, **Sign out**, **Sign up**). **Preserved intentionally:** | Category | Keep as-is | Example | | -------- | ---------- | ------- | | Feature name | social login | `/social-login`, `features.mdx` heading, OAuth provider section | | URL slugs | `login` in paths | `/phone-login`, `/login-flows`, `choosing-login-flow` | | CLI | `supabase login` / `supabase logout` | Reference ids `supabase-login` / `supabase-logout`; executable commands unchanged | | SDK methods | `logout()` | Kotlin/Swift method names in API reference titles and examples | | Third-party UI | Provider product labels | Facebook Login, Kakao Login, portal **Login** buttons | | Postgres | Database terminology | login privileges, login credentials, login via role | | Audit/logging | Log prose | "Generates the following **log** in the Postgres Logs" | | Code and routes | Paths and filenames | `app/login/`, `Login.tsx`, `demos/android-login` | | External URLs | Third-party login pages | `dash.cloudflare.com/login`, `console.neon.tech/login`, `vercel.com/login` | | API identifiers | Event and field names | Audit actions `login`/`logout`, `should_logout_user` | ## To test - Run `pnpm lint:mdx` in `apps/docs` - Spot-check `features.mdx`, `social-login.mdx`, and a provider guide (e.g. Facebook, Kakao) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Standardized authentication terminology across guides, reference material, CLI documentation, and copywriting guidance using “sign in,” “sign out,” and “sign up.” * Updated authentication instructions, headings, link text, examples, and SSO guidance for clearer, more consistent wording. * Corrected related grammar, spelling, hyphenation, and documentation links while preserving established product names and implementation commands. * **Style** * Refined code examples with consistent import ordering and spacing. * **Examples** * Updated authentication button and menu labels to “Sign in” and “Sign out.” <!-- end of auto-generated comment: release notes by coderabbit.ai -->
106 lines
5.3 KiB
Plaintext
106 lines
5.3 KiB
Plaintext
---
|
|
id: 'network-restrictions'
|
|
title: 'Network Restrictions'
|
|
description: "Apply network restrictions for your project's database."
|
|
---
|
|
|
|
This topic explains how to configure network restrictions for your Supabase project's database. Network restrictions let you control which IP ranges can connect to Postgres and its pooler, reducing your project's exposure to unauthorized access.
|
|
|
|
<Admonition type="note">
|
|
|
|
If you can't find the Network Restrictions section in your [Database Settings](/dashboard/project/_/database/settings), update your Postgres version in [General Settings](/dashboard/project/_/settings/general).
|
|
|
|
</Admonition>
|
|
|
|
Each Supabase project supports configurable restrictions on the IP ranges allowed to connect to Postgres and its pooler. These restrictions are enforced before traffic reaches your database. Connections that aren't restricted by IP still need to authenticate with valid database credentials.
|
|
|
|
If direct connections to your database [resolve to an IPv6 address](/dashboard/project/_/database/settings), add both IPv4 and IPv6 CIDRs to your allowlist. Network restrictions apply to all connection routes, whether pooled or direct. There are two exceptions: if you have an extension on the IPv6 migration, or if you have the [IPv4 add-on](/dashboard/project/_/settings/addons), you only need to add IPv4 CIDRs.
|
|
|
|
## Configure with the dashboard [#to-get-started-via-the-dashboard]
|
|
|
|
To configure network restrictions with the dashboard:
|
|
|
|
1. Open your project's [Database Settings](/dashboard/project/_/database/settings) page.
|
|
1. In the Network Restrictions section, make your changes. You need [Owner or Admin permissions](/docs/guides/platform/access-control#manage-team-members) to make changes.
|
|
|
|
## Configure with the CLI [#to-get-started-via-the-cli]
|
|
|
|
To configure network restrictions with the CLI:
|
|
|
|
1. [Install](/docs/guides/local-development) the Supabase CLI 1.22.0+.
|
|
1. [Sign in](/docs/guides/local-development/database-migrations#sign-in-to-the-supabase-cli) to your Supabase account.
|
|
1. If your project was created before December 23, 2022, [upgrade it to the latest Supabase version](/docs/guides/platform/upgrading) before using network restrictions.
|
|
1. Ensure you have [Owner or Admin permissions](/docs/guides/platform/access-control#manage-team-members) for the project.
|
|
|
|
### Check restrictions
|
|
|
|
To check your current network restrictions:
|
|
|
|
1. Complete the steps in [Configure with the CLI](#to-get-started-via-the-cli).
|
|
1. Run the `get` subcommand to retrieve the restrictions currently in effect:
|
|
|
|
```bash
|
|
> supabase network-restrictions get --project-ref {ref} --experimental
|
|
DB Allowed IPv4 CIDRs: &[183.12.1.1/24]
|
|
DB Allowed IPv6 CIDRs: &[2001:db8:3333:4444:5555:6666:7777:8888/64]
|
|
Restrictions applied successfully: true
|
|
```
|
|
|
|
If restrictions have never been applied, the allowed CIDRs list is empty and `Restrictions applied successfully` is `false`. All IPs can connect:
|
|
|
|
```bash
|
|
> supabase network-restrictions get --project-ref {ref} --experimental
|
|
DB Allowed IPv4 CIDRs: []
|
|
DB Allowed IPv6 CIDRs: []
|
|
Restrictions applied successfully: false
|
|
```
|
|
|
|
### Update restrictions
|
|
|
|
To update your network restrictions:
|
|
|
|
1. Complete the steps in [Configure with the CLI](#to-get-started-via-the-cli).
|
|
1. Run the `update` subcommand with the CIDRs you want to allow:
|
|
|
|
```bash
|
|
> supabase network-restrictions update --project-ref {ref} --db-allow-cidr 183.12.1.1/24 --db-allow-cidr 2001:db8:3333:4444:5555:6666:7777:8888/64 --experimental
|
|
DB Allowed IPv4 CIDRs: &[183.12.1.1/24]
|
|
DB Allowed IPv6 CIDRs: &[2001:db8:3333:4444:5555:6666:7777:8888/64]
|
|
Restrictions applied successfully: true
|
|
```
|
|
|
|
The CIDRs you provide replace any previously applied restrictions. To keep existing restrictions, include them alongside any new CIDRs in the `update` command.
|
|
|
|
### Append a CIDR to existing restrictions
|
|
|
|
To append a CIDR to your existing restrictions:
|
|
|
|
1. Complete the steps in [Configure with the CLI](#to-get-started-via-the-cli).
|
|
1. Run the `update` subcommand with the `--append` flag to add a CIDR without replacing existing restrictions:
|
|
|
|
```bash
|
|
> supabase network-restrictions update --project-ref {ref} --db-allow-cidr 1.2.3.4/32 --append --experimental
|
|
DB Allowed IPv4 CIDRs: &[183.12.1.1/24 1.2.3.4/32]
|
|
DB Allowed IPv6 CIDRs: &[2001:db8:3333:4444:5555:6666:7777:8888/64]
|
|
Restrictions applied successfully: true
|
|
```
|
|
|
|
### Remove restrictions
|
|
|
|
To remove all network restrictions:
|
|
|
|
1. Complete the steps in [Configure with the CLI](#to-get-started-via-the-cli).
|
|
1. Run the `update` subcommand with the CIDR `0.0.0.0/0` to remove all restrictions:
|
|
|
|
```bash
|
|
> supabase network-restrictions update --project-ref {ref} --db-allow-cidr 0.0.0.0/0 --db-allow-cidr ::/0 --experimental
|
|
DB Allowed IPv4 CIDRs: &[0.0.0.0/0]
|
|
DB Allowed IPv6 CIDRs: &[::/0]
|
|
Restrictions applied successfully: true
|
|
```
|
|
|
|
## Limitations
|
|
|
|
- Network restrictions apply to Postgres and the database pooler. They don't apply to HTTPS APIs such as PostgREST, Storage, and Auth, or to Supabase client libraries like [supabase-js](/docs/reference/javascript/introduction).
|
|
- With network restrictions applied, Edge functions lose direct access to the database. Use [supabase-js](/docs/reference/javascript/introduction) to connect to the database from Edge Functions instead.
|