Loading post…
Supabasetomas_pozo,katerina_skroumpelouAnnouncement
Supabase Middleware: composable, reusable middleware for Web Fetch handlers
Summary
Supabase released @supabase/middleware, a composable, type-safe library for Web Fetch handlers on October 2 at Supabase Select. It abstracts per-request logic like CORS handling, JWT verification, and feature flags into reusable entries that work across any fetch runtime and frameworks including Hono, H3, Elysia, NestJS, and TanStack Start. The pipeline function chains entries in order; each entry adds a typed key to a shared ctx object and can return a Response to short-circuit the chain, such as a 401 on invalid JWT. Built-in middleware includes withCors, withRequiredClaims, withSupabaseClient (scoped to the caller via RLS), and withPostgresAdminClient, and the pipeline produces a standard fetch handler portable to Node 22+, Deno, Bun, Cloudflare Workers, or frameworks via bridge files. Developers write custom middleware using defineMiddleware with compile-time type guarding for key conflicts and dependency order, and can share them as npm packages.
Context
Per-request logic such as CORS, authentication, and feature flags is duplicated across handlers, runtimes, and frameworks, creating maintenance burden and security risks.
Approach / What changed
A middleware library that uses a pipeline function to compose ordered, type-safe middleware entries into a standard fetch handler. Each entry handles one concern and adds a typed key to a shared ctx object. The same pipeline works on any fetch runtime and inside frameworks via a short bridge file.
Takeaways
Middleware entries in a pipeline execute sequentially; any entry can return a Response to halt the chain, enabling early rejection for invalid auth or missing flags.
Built-in middleware like withSupabaseClient provides a caller-scoped Supabase client that respects Row-Level Security, eliminating manual token scoping in each handler.
defineMiddleware enforces at compile time that middleware keys are unique and declared dependencies are satisfied, catching configuration errors before deployment.
FAQ
How does middleware work across different runtimes?
The pipeline function produces a standard fetch handler, which runs on any runtime that supports the Fetch API, including Node 22+, Deno, Bun, and Cloudflare Workers. For frameworks, a bridge file adapts the middleware to the framework's middleware format without rewriting the logic.
Can I use withPostgresClient on Cloudflare Workers?
No, because pg requires a TCP socket, which Cloudflare Workers do not provide. On Workers, use withSupabaseClient and ctx.supabase instead.
How do I create custom middleware?
Use defineMiddleware with a key, a run function that returns a request handler, and type parameters for config, dependencies, and outputs. TypeScript 5.4+ catches key conflicts and missing dependencies at compile time.
Source and freshness
- Source
- supabase.com
- Published
- Added to Yomu
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.