10/09/2025
🔄 𝐅𝐨𝐥𝐥𝐨𝐰-𝐮𝐩 𝐨𝐧 𝐌𝐲 𝐒𝐮𝐩𝐚𝐛𝐚𝐬𝐞 𝐀𝐮𝐭𝐡: 𝐅𝐫𝐨𝐧𝐭𝐞𝐧𝐝 𝐯𝐬 𝐁𝐚𝐜𝐤𝐞𝐧𝐝
A while ago, I asked whether to handle Supabase authentication directly in the frontend (JS SDK) or route it through my 𝐅𝐚𝐬𝐭𝐀𝐏𝐈 backend (Python SDK).
After exploring both options (and reading some great insights), I’ve decided to go with 𝐛𝐚𝐜𝐤𝐞𝐧𝐝-𝐫𝐨𝐮𝐭𝐞𝐝 𝐚𝐮𝐭𝐡𝐞𝐧𝐭𝐢𝐜𝐚𝐭𝐢𝐨𝐧, and here’s why:
🔒 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 & 𝐂𝐨𝐧𝐭𝐫𝐨𝐥
- Sensitive operations stay server-side where I have full control.
- API keys and secrets are never exposed in the browser.
- Easy to add validation, rate limiting, and custom security rules.
- Authentication flows are easier to audit and monitor.
🛠 𝐂𝐨𝐧𝐬𝐢𝐬𝐭𝐞𝐧𝐜𝐲 & 𝐀𝐫𝐜𝐡𝐢𝐭𝐞𝐜𝐭𝐮𝐫𝐞
- All API calls flow through the backend, creating a unified interface.
- Middleware can handle logging, monitoring, and error handling consistently.
- Clear separation of concerns between frontend and backend.
- Simple to extend auth flows with business logic (welcome emails, user onboarding, etc.)
🌍 𝐅𝐥𝐞𝐱𝐢𝐛𝐢𝐥𝐢𝐭𝐲 𝐟𝐨𝐫 𝐭𝐡𝐞 𝐅𝐮𝐭𝐮𝐫𝐞
- Can switch auth providers without major frontend changes.
- Easier to support custom authentication logic.
- Plays nicely with server-side rendering and scaling needs.
For me, this approach balances security, scalability, and maintainability and gives me more flexibility as the app grows.
