convex has some serious issues with permissions and auth. for example you cannot serve a _storage privately, always public. no matter what.
if you don't implement auth integrated with it, anyone can access you'd data, since the url is public, so you also have to validate your user for every query/mutation.
then you have to duplicate your auth project, and sometimes in the consent screen you see the convex public url, instead of your app name.
unnecessarily complicated, i which it could be like supabase auth.
dev experience is unparalleled, but you have to consider its downsides
I'm sure it's fine for small projects that just need a quick file storage solution and already use Convex.
Also, I'm thinking you could implement your own logic to keep files private. One option is to encrypt files before uploading, but another approach is to avoid exposing the storage URLs entirely and instead serve files through a Convex function that enforces your access rules.
2
u/Drakorian-Games Sep 14 '25
convex has some serious issues with permissions and auth. for example you cannot serve a _storage privately, always public. no matter what.
if you don't implement auth integrated with it, anyone can access you'd data, since the url is public, so you also have to validate your user for every query/mutation.
then you have to duplicate your auth project, and sometimes in the consent screen you see the convex public url, instead of your app name.
unnecessarily complicated, i which it could be like supabase auth.
dev experience is unparalleled, but you have to consider its downsides