IP detection in redirect url breaks Expo Go deep linking
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 55/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Stale
- Tech stack
- go, react-native
- Domain
- authentication
Research direction
Start by reading internal/utilities/request.go around the IP-matching code at line 103, then reproduce the redirect validation with the documented Expo Go URL and an IP-based host URL. Done means Expo Go deep links with an IP in the later URL portion are accepted while redirects using an actual IP remain flagged.
Written by the indexing model from the issue text.
Description
Bug report
- [ x] I confirm this is a bug with Supabase, not with my own application.
- [ x] I confirm I have searched the Docs, GitHub Discussions, and Discord.
Describe the bug
When trying to redirect to a deep link while using expo go, supabase blocks the redirect url of exp://192.168.22.47:8081/--/auth because of the ip matching.
To Reproduce
- Add exp://** as an additional redirect url
- Set the redirect url for an oauth singin to expo go's deep link url (i.e. exp://192.168.22.47:8081/--/auth)
Expected behavior
Still flags redirects to actual ips, but if the ips are a part of the latter part of the url like above, it should continue
System information
- OS: Linux (Host) Android (React Native + Expo)
- Version of supabase-js: 2.49.5-next.1
- Version of Node.js: 23.8.0
Additional context
The ip matching code:
https://github.com/supabase/auth/blob/a7b006acc01eea0a739580700ee3d7d78c794d4c/internal/utilities/request.go#L103
- Dominant language
- Go
- Stars
- 2.6k
- Forks
- 764
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 39
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from supabase/auth
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 1/5 Under an hour Newbie friendliness 86/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Similar issues
-
optimization optimization:agents-md-curator
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
githubnext/gh-aw-cao#13143 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
blinklabs-io/bursa#904 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
yanet-platform/ipfw-go#129 ·
-
bug confmap/provider/googlesecretmanagerprovider needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
open-telemetry/opentelemetry-collector-contrib#51273 · 2 comments ·
-
bug: AI Gateway client filter lists "Unknown" twice when NULL and literal Unknown clients coexist Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 90/100