

This is fundamentally how Firebase etc. is meant to work: the client talks directly to the database, and security rules gate access. You don’t need your own backend in between.
As for the spam issue, you’re right that supabase can’t do it (firebase can btw.)
https://github.com/orgs/supabase/discussions/36512
https://github.com/orgs/supabase/discussions/19493
Not sure what the best approach is, but for me it just sounds like supabase is not ready for real world production.




ps:
trailbase seems to do user rate limiting by ip through a reverse proxy. I’m sure the same can be done for supabase. https://trailbase.io/documentation/production/#reverse-proxy