3 Supabase RLS mistakes I keep seeing in real projects (and the fix for each)
Row Level Security (RLS) is what stands between your users and each other's data in Supabase. These are three mistakes that show up again and again, with the fix for each. 1. RLS was never enabled A table created with plain SQL has RLS switched off. Turn it on and add a policy: alter table notes enable row level security ; create policy "owner can read" on notes for select using ( auth . uid () =…
Row Level Security (RLS) plays a crucial role in safeguarding user data on Supabase. This article highlights three common mistakes encountered in real projects, along with their respective fixes.
Firstly, RLS often remains disabled when tables are created using plain SQL. To enable RLS, execute the following command: `alter table notes enable row level security;`. Additionally, create a policy specifying the allowed actions for the owner: `create policy "owner can read" on notes for select using (auth.uid() = user_id);`.
Secondly, views can inadvertently bypass RLS if proper measures are not taken. By default, a view runs with its owner's rights. To prevent potential data exposure, create the view with `security_invoker = true` (Postgres 15 and newer): `create view my_notes with (security_invoker = true) as select * from notes;`.
Lastly, policies should refrain from utilizing `user_metadata` when determining roles or permissions. User_metadata can be edited by users themselves, making it unsuitable for such purposes. Instead, leverage `app_metadata` or establish a dedicated roles table that is exclusively writable by your server. For additional RLS patterns, explore the comprehensive guide available at <https://getcodenest.com/products/supabase-rls-policy-cookbook>.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
