Security Center
Review authentication, authorization and server-side protection for the Habitat IAS administration system.
Admin Authorization
Checking the current administrator session...
Checking
Authentication
Current authentication protection.
Supabase Authentication
User identity is validated through Supabase.
Server-side Session Validation
Access tokens are validated on the server.
Admin Authorization
The authenticated user is compared against the server-side administrator ID.
Secret Protection
Sensitive credentials and configuration.
Supabase Service Role Key
Used only by server-side API routes.
Administrator User ID
Stored in server environment configuration.
Environment Variables
Private configuration is not rendered into this page.
Server Security
Protection applied to administrator operations.
Server-side authorization
Administrator access is verified on the server rather than relying only on browser UI.
Service-role key isolation
The Supabase service-role key is not exposed to client-side JavaScript.
No sensitive API response data
The admin authorization endpoint returns only authorization status.
Session verification
Invalid or expired authentication sessions are rejected by the server.
Authorization API
Live status returned by the admin authorization endpoint.
Endpoint
/api/admin/access
Security Rules
Important rules for maintaining the administration system.
Never expose the Supabase service-role key
It must remain in server environment variables and must never be placed in public Astro code, browser JavaScript or client-side API requests.
Never expose ADMIN_USER_ID
Administrator identity should remain a server-side authorization detail.
Do not rely on hidden buttons for security
Hiding an admin button in the browser does not provide authorization. Server-side authorization must always be enforced.
Keep payment verification server-side
Student access must continue to depend on verified purchase or approved manual access, not on browser-controlled values.
⚠ Security Reminder
Never paste your Supabase service-role key, payment gateway secret, webhook secret or other private credentials into a browser-side Astro page. Keep all sensitive credentials in server environment variables and use protected server-side API routes for operations requiring those credentials.