Setting the file. One moment.
Skill 01 · Supabase Postgres Best Practices
Subchapter 1.33
references/security-rls-basics.mdMarkdown1 KBView on GitHub
Row Level Security (RLS) enforces data access at the database level, ensuring users only see their own data.
Incorrect (application-level filtering only):
-- Relying only on application to filter
select * from orders where user_id = $current_user_id;
-- Bug or bypass means all data is exposed!
select * from orders; -- Returns ALL ordersCorrect (database-enforced RLS):
-- Enable RLS on the table
alter table orders enable row level security;
-- Create policy for users to see only their orders
create policy orders_user_policy on orders
for all
using (user_id = current_setting('app.current_user_id')::bigint);
-- Force RLS even for table owners
alter table orders force row level security;
-- Set user context and query
set app.current_user_id = '123';
select * from orders; -- Only returns orders for user 123Policy for authenticated role:
create policy orders_user_policy on orders
for all
to authenticated
using (user_id = auth.uid());Reference: Row Level Security (opens in a new tab)