Database / Supabase Intermediate to Advanced Interview Questions
Why should you avoid embedding sensitive business data directly inside JWT claims?
A JWT's payload is only signed, not encrypted, meaning anyone holding the token — including the end user themselves, since it's stored client-side — can decode and read every claim inside it without ever contacting Supabase's servers.
Putting something like a user's exact salary, an internal risk score, or another user's private data into a claim effectively hands it to the client in plain sight, even if your UI never displays it. Claims are best limited to identifiers and flags that are safe to expose (a role name, an organization ID, a subscription tier), while anything genuinely sensitive should stay server-side and be fetched through an authorized query when actually needed.
Why can any holder of a JWT read its claims without contacting the server?
What kind of data is generally safe to include in a JWT claim?
More Related questions...
