Securing Mobile Commerce in Flutter: Role-Based Access Control and Supabase RLS

1. The Mobile Threat Model: Decompiled APKs and Proxy Interception

Mobile applications run in an untrusted environment controlled entirely by the user. Anyone can decompile your Flutter APK using tools like apktool or jadx, inspect compiled assets, intercept HTTPS traffic using Charles Proxy or Burp Suite, or alter memory states with Frida.

Any developer who relies on Flutter logic like if (user.role == 'admin') showDeleteButton() without enforcing the identical policy at the database level has left their application completely vulnerable to unauthorized data tampering.

---

2. The Fallacy of Client-Side Authorization

In Flutter, client-side RBAC (Role-Based Access Control) exists solely to provide a clean **user experience**: - It hides irrelevant management buttons from regular shoppers. - It prevents confusing navigation errors before a request is fired.

However, **authorization is exclusively a server and database responsibility**. If a regular customer dispatches an HTTP PATCH /orders/456 payload through a proxy with {"status": "delivered"}, the backend must reject the query based on cryptographically signed JWT claims.

---

3. Designing PostgreSQL Row-Level Security (RLS) Policies

When using a backend like Supabase or PostgreSQL with PostgREST, Row-Level Security (RLS) enables declarative security rules directly in the database engine:

sql

-- Enable Row Level Security on the orders table
ALTER TABLE orders ENABLE ROW LEVEL SECURITY;-- 1. Customers can ONLY read their own orders
CREATE POLICY "Customers can select own orders"
ON orders FOR SELECT
TO authenticated
USING (auth.uid() = customer_id);-- 2. Only store operators and super admins can update order statuses
CREATE POLICY "Operators and Admins can update orders"
ON orders FOR UPDATE
TO authenticated
USING (
  EXISTS (
    SELECT 1 FROM user_roles
    WHERE user_roles.user_id = auth.uid()
      AND user_roles.role IN ('order_operator', 'super_admin')
  )
);

With these policies enabled, even if a malicious user captures an API key from the app binary, the PostgreSQL query engine isolates their access exclusively to rows matching their verified JWT token.

---

4. Clean Flutter RBAC Route Guards & Component Visibility

In your Flutter UI, encapsulate role permissions into a clean, reusable permission wrapper widget:

dart

import 'package:flutter/material.dart';
enum UserRole { guest, customer, catalogManager, orderOperator, superAdmin }class SecurityContext {
  final UserRole currentRole;
  final String userId;
  const SecurityContext({required this.currentRole, required this.userId});  bool hasPermission(Set<UserRole> allowedRoles) => allowedRoles.contains(currentRole);
}class RoleRestrictedGuard extends StatelessWidget {
  final SecurityContext contextData;
  final Set<UserRole> allowedRoles;
  final Widget child;
  final Widget? fallback;  const RoleRestrictedGuard({
    super.key,
    required this.contextData,
    required this.allowedRoles,
    required this.child,
    this.fallback,
  });  @override
  Widget build(BuildContext context) {
    if (contextData.hasPermission(allowedRoles)) {
      return child;
    }
    return fallback ?? const SizedBox.shrink();
  }
}

---

5. Secure Token Storage, Rotation & Session Expiry

Never store authentication tokens, refresh keys, or customer credentials in standard SharedPreferences or localStorage, as plain text is easily extracted on rooted Android devices.

Instead, use hardware-backed keystores: - Android: EncryptedSharedPreferences with Android Keystore. - iOS: Keychain Services with kSecAttrAccessibleAfterFirstUnlock. - Web: HttpOnly, Secure, SameSite cookies or Web Crypto encrypted storage.

Test the interactive RBAC sandbox inside the [WidgetExamples Store Admin](/app-builder/admin).

Securing Mobile Commerce in Flutter: Role-Based Access Control and Supabase RLS

1. The Mobile Threat Model: Decompiled APKs and Proxy Interception

2. The Fallacy of Client-Side Authorization

3. Designing PostgreSQL Row-Level Security (RLS) Policies

4. Clean Flutter RBAC Route Guards & Component Visibility

5. Secure Token Storage, Rotation & Session Expiry

Was this guide helpful?

Suggest an improvement or ask a question

About Chirag Shyani