Blog
Supabase Edge Functions: CORS, anon keys, and JWT exchange patterns for browser clients
Edge Functions run close to users but still need explicit Access-Control headers; the service role key must never ship to browsers.
1 min read
supabaseedge-functionscors
Regional cold starts
First invocations after idle can delay preflight responses—set conservative timeouts in fetch wrappers.
Pin function versions in production to avoid surprise header changes during deploys.
Row Level Security
RLS policies apply after JWT validation; misconfigured policies can look like opaque 401s rather than CORS failures.
Log auth.uid() mismatches separately from CORS denials in client telemetry.