Select policies for read access in Supabase

Introduction

Select policies control who can read data from your database. They keep your data safe by allowing only the right people to see it.

You want to let users see their own data but not others'.

You need to allow public read access to some data, like product listings.

You want to restrict read access to logged-in users only.

You want to filter data so users only see records matching certain conditions.

Syntax

Supabase

CREATE POLICY policy_name ON table_name
FOR SELECT
USING (condition);

The USING clause defines who can read the data by specifying a condition.

Policies must be enabled on the table for them to work.

Examples

This policy lets users read only their own profile data by matching their user ID.

Supabase

CREATE POLICY "Allow logged-in users to read"
ON profiles
FOR SELECT
USING (auth.uid() = user_id);

This policy allows anyone to read all products because the condition is always true.

Supabase

CREATE POLICY "Public read access"
ON products
FOR SELECT
USING (true);

Sample Program

This example creates a messages table and a policy that lets users read only their own messages by matching their user ID with the authenticated user ID.

Supabase

CREATE TABLE messages (
  id SERIAL PRIMARY KEY,
  user_id UUID,
  content TEXT
);

-- Enable row level security
ALTER TABLE messages ENABLE ROW LEVEL SECURITY;

-- Policy: users can read only their own messages
CREATE POLICY "Users can read own messages"
ON messages
FOR SELECT
USING (auth.uid() = user_id);

Important Notes

Always test your policies to make sure they allow the right access.

Remember to enable row level security on the table before creating policies.

Summary

Select policies control who can read data in your tables.

Use the USING clause to set conditions for read access.

Enable row level security to activate policies.

Practice

1. What is the main purpose of a SELECT policy in Supabase?

easy

A. To control who can read data from a table

B. To control who can write data to a table

C. To create new tables in the database

D. To delete data from a table

Solution

1. Step 1: Understand the role of SELECT policies

   SELECT policies define rules for reading data from tables.

2. Step 2: Differentiate from other policies

   Write policies control data insertion or updates, not reading.

3. Final Answer:

   To control who can read data from a table -> Option A

4. Quick Check:

   SELECT policy = read access control [OK]

Hint: SELECT policies = rules for reading data only [OK]

Common Mistakes:

• Confusing SELECT with INSERT or UPDATE policies
• Thinking SELECT policies create or delete tables
• Assuming SELECT policies control write access

2. Which of the following is the correct syntax to create a read policy allowing all users to select from a table named profiles?

easy

A. CREATE POLICY "Allow all" ON profiles FOR UPDATE USING (true);

B. CREATE POLICY "Allow all" ON profiles FOR INSERT USING (true);

C. CREATE POLICY "Allow all" ON profiles FOR SELECT USING (true);

D. CREATE POLICY "Allow all" ON profiles FOR DELETE USING (true);

Solution

1. Step 1: Identify the correct command for read access

   FOR SELECT is used to allow read (select) operations.

2. Step 2: Confirm the condition for allowing all users

   USING (true) means no restriction, so all users can read.

3. Final Answer:

   CREATE POLICY "Allow all" ON profiles FOR SELECT USING (true); -> Option C

4. Quick Check:

   FOR SELECT + USING (true) = allow all read [OK]

Hint: FOR SELECT + USING (true) allows all reads [OK]

Common Mistakes:

• Using FOR INSERT instead of FOR SELECT
• Forgetting the USING clause
• Using FOR DELETE or UPDATE for read access

3. Given the policy:

CREATE POLICY "User can read own profile" ON profiles FOR SELECT USING (auth.uid() = user_id);

What will happen if a user tries to select a profile where user_id is different from their auth.uid()?

medium

A. The user will be able to read the profile

B. The user will get an empty result (no rows)

C. The query will cause a syntax error

D. The user will be able to update the profile

Solution

1. Step 1: Understand the policy condition

   The policy allows reading only if auth.uid() equals user_id.

2. Step 2: Analyze the case when user_id differs

   If user_id is different, the condition fails, so no rows are returned.

3. Final Answer:

   The user will get an empty result (no rows) -> Option B

4. Quick Check:

   Condition false = no rows returned [OK]

Hint: Read allowed only if auth.uid() matches user_id [OK]

Common Mistakes:

• Assuming user can read all profiles
• Expecting an error instead of empty result
• Confusing read with update permissions

4. You wrote this policy:

CREATE POLICY "Allow read" ON orders FOR SELECT USING (user_id = auth.uid);

But users cannot read their orders. What is the problem?

medium

A. USING clause should be omitted

B. The policy should use FOR UPDATE instead of FOR SELECT

C. The table name is incorrect

D. auth.uid should be called as a function: auth.uid()

Solution

1. Step 1: Check the usage of auth.uid

   auth.uid is a function and must be called with parentheses: auth.uid()

2. Step 2: Understand impact of missing parentheses

   Without (), the condition is invalid and blocks access.

3. Final Answer:

   auth.uid should be called as a function: auth.uid() -> Option D

4. Quick Check:

   auth.uid() is required for correct condition [OK]

Hint: Always call auth.uid() with parentheses [OK]

Common Mistakes:

• Using auth.uid without parentheses
• Confusing FOR SELECT with FOR UPDATE
• Removing USING clause mistakenly

5. You want to allow users to read only their own messages from a messages table. The table has columns id, content, and owner_id. Which policy correctly enforces this read access?

hard

A. CREATE POLICY "Read own messages" ON messages FOR SELECT USING (owner_id = auth.uid());

B. CREATE POLICY "Read own messages" ON messages FOR SELECT USING (owner_id != auth.uid());

C. CREATE POLICY "Read own messages" ON messages FOR SELECT USING (true);

D. CREATE POLICY "Read own messages" ON messages FOR UPDATE USING (owner_id = auth.uid());

Solution

1. Step 1: Identify correct condition for own data

   Users should read rows where owner_id equals their auth.uid()

2. Step 2: Confirm correct policy type and condition

   FOR SELECT with USING (owner_id = auth.uid()) restricts reads properly.

3. Final Answer:

   CREATE POLICY "Read own messages" ON messages FOR SELECT USING (owner_id = auth.uid()); -> Option A

4. Quick Check:

   owner_id = auth.uid() restricts read to own rows [OK]

Hint: Use owner_id = auth.uid() in USING for own read access [OK]

Common Mistakes:

• Using != instead of = in condition
• Allowing all reads with USING (true)
• Using FOR UPDATE instead of FOR SELECT