0Pricing
Supabase Backend as a Service · Aula

Gerenciamento de sessões e perfis de usuários

Aprenda a gerenciar sessões de usuários, recuperar metadados e atualizar perfis de usuários com segurança na sua aplicação.

Gerenciamento de sessões e perfis de usuários é uma aula grátis de Supabase Backend as a Service no CoddyKit. Esta é a aula 3 de 4. Você pode ler a aula completa abaixo gratuitamente — depois pratica ao vivo no navegador com um editor de código integrado e um tutor de IA 24/7. Faz parte do caminho de aprendizado de Supabase Backend as a Service, e seu progresso é sincronizado entre a web e o app CoddyKit. O curso de Supabase Backend as a Service inclui 4 aulas no total.

Partes desta aula ainda não foram traduzidas e aparecem em inglês.

User Sessions & Profiles Intro

Welcome! In this lesson, we'll dive into managing user sessions and updating user profiles securely with Supabase.

When a user logs in, Supabase creates a session. This session keeps track of who the user is and ensures they remain authenticated across requests.

A user's profile often includes details like their name, avatar, or preferences. Supabase helps you store and manage this data.

Accessing the Current Session

To interact with the currently logged-in user, you first need to access their session. Supabase stores session tokens securely, usually in local storage or cookies.

You can retrieve the active session using supabase.auth.getSession(). This call returns a Promise that resolves with the session data.

import { createClient } from '@supabase/supabase-js';

const supabaseUrl = 'YOUR_SUPABASE_URL';
const supabaseAnonKey = 'YOUR_SUPABASE_ANON_KEY';

const supabase = createClient(supabaseUrl, supabaseAnonKey);

async function getCurrentSession() {
  const { data: { session }, error } = await supabase.auth.getSession();

  if (error) {
    console.error('Error getting session:', error.message);
    return;
  }

  if (session) {
    console.log('Current session:', session);
    console.log('User ID:', session.user.id);
    console.log('User email:', session.user.email);
  } else {
    console.log('No active session.');
  }
}

getCurrentSession();

Exploring the User Object

The session object contains a user property, which holds important information about the authenticated user.

Key properties within the user object include:

  • id: A unique identifier for the user.
  • email: The user's email address.
  • created_at: When the user account was created.
  • user_metadata: A JSON object for custom profile data.

We often store things like a user's display name or avatar URL in user_metadata.

Accessing User Profile Data

The user_metadata field within the user object is where you can store custom profile information. This data is part of the authentication service, not your main database tables.

It's a flexible JSON object, allowing you to store various details directly tied to the user's authentication record.

import { createClient } from '@supabase/supabase-js';

const supabaseUrl = 'YOUR_SUPABASE_URL';
const supabaseAnonKey = 'YOUR_SUPABASE_ANON_KEY';

const supabase = createClient(supabaseUrl, supabaseAnonKey);

async function getUserProfile() {
  const { data: { user }, error } = await supabase.auth.getUser();

  if (error) {
    console.error('Error getting user:', error.message);
    return;
  }

  if (user) {
    console.log('User ID:', user.id);
    console.log('Email:', user.email);
    console.log('User Metadata:', user.user_metadata);

    // Access specific metadata
    const displayName = user.user_metadata?.display_name || 'Guest';
    console.log('Display Name:', displayName);
  } else {
    console.log('No user logged in.');
  }
}

getUserProfile();

Modifying User Profile Data

To update a user's profile information, specifically their user_metadata, you use the supabase.auth.updateUser() method.

You pass an object to this method, with a data property that contains the new user_metadata. Supabase will merge this new data with any existing metadata.

  • Security Note: Always ensure you have appropriate Row-Level Security (RLS) policies in your database if you store sensitive profile data there. For user_metadata, Supabase handles its security.

Live Update User Metadata

Let's update a user's display name and add an avatar URL to their user_metadata.

Remember, the data property is for fields like user_metadata. Other fields like email or password are updated differently.

import { createClient } from '@supabase/supabase-js';

const supabaseUrl = 'YOUR_SUPABASE_URL';
const supabaseAnonKey = 'YOUR_SUPABASE_ANON_KEY';

const supabase = createClient(supabaseUrl, supabaseAnonKey);

async function updateProfile() {
  // This assumes a user is already logged in
  const { data: { user }, error: getUserError } = await supabase.auth.getUser();

  if (getUserError || !user) {
    console.error('No user logged in or error getting user:', getUserError?.message);
    return;
  }

  const { data, error } = await supabase.auth.updateUser({
    data: {
      display_name: 'Coddy Learner',
      avatar_url: 'https://example.com/coddy_avatar.png'
    }
  });

  if (error) {
    console.error('Error updating user metadata:', error.message);
  } else {
    console.log('Profile updated successfully!', data.user.user_metadata);
  }
}

// In a real app, you'd call this after a user logs in
// or on a profile settings page.
// For this example, assume a user is logged in.
updateProfile();

Changing Email & Password

Besides user_metadata, users can also update their email address and password.

  • Updating Email: Requires a confirmation flow. The user receives an email with a link to confirm the new address.
  • Updating Password: Directly changes the password. For security, always prompt the user to re-authenticate or enter their current password before allowing a change.

These are also handled via supabase.auth.updateUser(), but you pass the email or password property directly, not within the data object.

Ending a User Session

When a user wants to log out, you need to terminate their active session. This securely removes their authentication tokens and prevents further access to protected resources.

The supabase.auth.signOut() method handles this process for you. It invalidates the session and clears any stored tokens.

After signing out, it's good practice to redirect the user to a public page (e.g., login screen) and clear any client-side application state related to the user.

Logging Out a User

This simple code snippet demonstrates how to sign out a user. After this, their session will be invalid.

import { createClient } from '@supabase/supabase-js';

const supabaseUrl = 'YOUR_SUPABASE_URL';
const supabaseAnonKey = 'YOUR_SUPABASE_ANON_KEY';

const supabase = createClient(supabaseUrl, supabaseAnonKey);

async function signOutUser() {
  const { error } = await supabase.auth.signOut();

  if (error) {
    console.error('Error signing out:', error.message);
  } else {
    console.log('User signed out successfully!');
    // You might redirect the user here
    // window.location.href = '/login';
  }
}

// Call this function when a user clicks a "Logout" button
signOutUser();

Security for Profile Management

When managing user profiles, security is paramount:

  • Row-Level Security (RLS): If you store profile data in separate database tables (e.g., a profiles table), always implement RLS to ensure users can only read/update their own data.
  • Client-side Validation: While important for user experience, never rely solely on client-side validation. Always validate data on the server (e.g., using Edge Functions or database constraints).
  • Sensitive Data: Avoid storing highly sensitive information directly in user_metadata. For truly sensitive data, consider encrypted storage or dedicated, strictly controlled database tables.

Profile Update Check

You want to update a user's display name and favorite color, which are stored in their custom profile data.

Which method and property should you use with the Supabase client library?

Session & Profile Recap

Great job! You've learned how to manage user sessions and profiles:

  • Accessed the current user's session and user object.
  • Retrieved and updated custom user_metadata using supabase.auth.updateUser({ data: {...} }).
  • Understood how to handle email/password updates.
  • Implemented user logout with supabase.auth.signOut().
  • Reviewed key security considerations for profile data.

Next, you might explore integrating social logins or advanced RLS for profile tables!

Perguntas Frequentes

A aula “Gerenciamento de sessões e perfis de usuários” é grátis?

Sim — o texto completo de “Gerenciamento de sessões e perfis de usuários” é grátis para ler aqui na web. Para praticá-la interativamente (um editor de código integrado e um tutor de IA 24/7) e desbloquear o restante do curso de Supabase Backend as a Service, atualize para CoddyKit PRO. O curso de Supabase Backend as a Service inclui 4 aulas no total.

O que vou aprender em “Gerenciamento de sessões e perfis de usuários”?

Aprenda a gerenciar sessões de usuários, recuperar metadados e atualizar perfis de usuários com segurança na sua aplicação. Você pratica Supabase Backend as a Service com código prático que executa diretamente no navegador, e um tutor de IA 24/7 responde suas dúvidas enquanto trabalha na aula.

Preciso ter experiência prévia para começar Supabase Backend as a Service?

Nenhuma experiência prévia é necessária. Supabase Backend as a Service no CoddyKit é estruturado para alunos iniciantes até avançados, então você pode começar aqui ou desde o início e aprender no seu ritmo. Esta é a aula 3 de 4.

Quanto tempo leva a aula “Gerenciamento de sessões e perfis de usuários”?

A maioria das aulas CoddyKit leva cerca de 5–10 minutos. Cada uma é compacta e interativa, então você faz progresso constante e retoma exatamente de onde parou entre web e app.

Posso escrever e executar código nesta aula de Supabase Backend as a Service?

Sim. Cada aula de Supabase Backend as a Service inclui um editor de código integrado, então você escreve e executa código real direto no navegador e recebe feedback de IA instantaneamente — nenhuma configuração local necessária.

Todas as aulas deste curso

  1. Registro de usuários com e-mail e senha
  2. Logins sociais (provedores OAuth)
  3. Gerenciamento de sessões e perfis de usuários
  4. Redefinição de Senha e Autenticação por Link Mágico
← Voltar para Supabase Backend as a Service