Storage policies for access control in Supabase - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Supabase Storage Policies

Which statement best describes the purpose of storage policies in Supabase?

A They define who can upload, download, or delete files in storage buckets.

B They control the physical location where files are stored in Supabase.

C They encrypt files on the client side before uploading.

D They automatically back up files to external cloud providers.

💡 Hint

Think about what access control means for stored files.

Storage policies in Supabase specify which users or roles can perform actions like upload, download, or delete on storage buckets or files.

❓ Configuration

intermediate

Policy to Allow Only Authenticated Users to Upload

Which Supabase storage policy allows only authenticated users to upload files to a bucket?

Supabase

CREATE POLICY "Allow authenticated uploads" ON storage.objects FOR INSERT WITH CHECK (auth.role() = 'authenticated');

A CREATE POLICY "Allow authenticated uploads" ON storage.objects FOR INSERT USING (auth.role() = 'authenticated');

B CREATE POLICY "Allow uploads" ON storage.objects FOR UPDATE USING (auth.role() = 'authenticated');

C CREATE POLICY "Allow all uploads" ON storage.objects FOR INSERT USING (true);

D CREATE POLICY "Allow uploads" ON storage.objects FOR INSERT WITH CHECK (auth.role() = 'authenticated');

💡 Hint

Look for a policy that uses FOR INSERT and checks the authenticated role.

The policy must be FOR INSERT to allow uploads and use WITH CHECK clause to check the user's role is 'authenticated'.

❓ Architecture

advanced

Designing Access Control for Public and Private Buckets

You want to create two buckets: one public for images anyone can view, and one private for user documents only the owner can access. Which policy setup achieves this?

A Public bucket: policy allows all users FOR SELECT; Private bucket: policy allows only owner FOR ALL actions.

B Public bucket: no policies (default deny); Private bucket: policy allows all authenticated users FOR ALL actions.

C Public bucket: policy allows only authenticated users FOR SELECT; Private bucket: policy allows owner FOR SELECT and INSERT only.

D Public bucket: policy allows all users FOR INSERT; Private bucket: policy allows only owner FOR DELETE.

💡 Hint

Public means anyone can view, private means only owner can do everything.

Public bucket must allow anyone to read (SELECT). Private bucket must restrict all actions to the owner only.

❓ security

advanced

Preventing Unauthorized File Deletion

Which policy prevents users from deleting files they do not own in a Supabase storage bucket?

A CREATE POLICY "Allow delete authenticated" ON storage.objects FOR DELETE USING (auth.role() = 'authenticated');

B CREATE POLICY "Allow delete all" ON storage.objects FOR DELETE USING (true);

C CREATE POLICY "Allow delete own files" ON storage.objects FOR DELETE USING (auth.uid() = owner);

D CREATE POLICY "Allow delete admin" ON storage.objects FOR DELETE USING (auth.role() = 'admin');

💡 Hint

Check for a policy that compares user ID with file owner.

Only the owner should be allowed to delete their files, so the policy must check auth.uid() equals the owner field.

❓ service_behavior

expert

Effect of Missing Storage Policy on File Access

If a Supabase storage bucket has no policies defined, what happens when a user tries to download a file?

A The download is allowed because Supabase storage is public by default.

B The download is denied because default policy denies all access without explicit permission.

C The download triggers an error because the bucket is misconfigured.

D The download is allowed only if the user is authenticated.

💡 Hint

Think about default security behavior when no policies exist.

Supabase storage denies all access by default unless policies explicitly allow it.

Practice

1. What is the main purpose of storage policies in Supabase?

easy

A. To increase storage space automatically

B. To speed up file uploads

C. To control who can read, upload, or delete files

D. To backup files to another server

Solution

1. Step 1: Understand storage policies

   Storage policies define rules about who can access or change files.

2. Step 2: Identify the main goal

   The main goal is to control access like reading, uploading, or deleting files to keep data safe.

3. Final Answer:

   To control who can read, upload, or delete files -> Option C

4. Quick Check:

   Storage policies = Access control [OK]

Hint: Storage policies = who can do what with files [OK]

Common Mistakes:

• Thinking policies increase storage size
• Confusing policies with backup features
• Believing policies speed up uploads

2. Which of the following is the correct syntax to allow only authenticated users to read files in Supabase storage policy?

easy

A. allow read if user.is_authenticated

B. using (auth.uid() != null)

C. check auth.user == true

D. permit read where auth.id exists

Solution

1. Step 1: Recall Supabase policy syntax

   Supabase uses SQL-like expressions with functions like auth.uid() to check user identity.

2. Step 2: Identify correct condition for authenticated users

   auth.uid() returns user ID if logged in, so checking auth.uid() != null allows only authenticated users.

3. Final Answer:

   using (auth.uid() != null) -> Option B

4. Quick Check:

   auth.uid() != null = authenticated user check [OK]

Hint: Use auth.uid() to check if user is logged in [OK]

Common Mistakes:

• Using incorrect property names like user.is_authenticated
• Writing non-SQL syntax like permit or allow keywords
• Checking auth.id instead of auth.uid()

3. Given this storage policy snippet:

using (bucket_id = 'public' OR auth.uid() = owner_id)

What does this policy allow?

medium

A. Anyone can access files in the 'public' bucket or owners can access their files

B. Only owners can access files in any bucket

C. Only users with bucket_id 'public' can access files

D. No one can access files unless they are owners

Solution

1. Step 1: Analyze the condition

   The condition allows access if bucket_id equals 'public' OR if the user's ID matches owner_id.

2. Step 2: Interpret the meaning

   This means anyone can access files in the 'public' bucket, and owners can access their own files in any bucket.

3. Final Answer:

   Anyone can access files in the 'public' bucket or owners can access their files -> Option A

4. Quick Check:

   bucket_id='public' OR auth.uid()=owner_id = public or owner access [OK]

Hint: OR means either public bucket or owner access allowed [OK]

Common Mistakes:

• Thinking only owners have access
• Assuming bucket_id restricts all access
• Ignoring the OR condition

4. You wrote this policy:

using (auth.uid() = owner_id AND bucket_id = 'private')

But users report they cannot read their private files. What is the likely problem?

medium

A. The policy blocks access because AND requires both conditions, but bucket_id might differ

B. auth.uid() is not a valid function

C. owner_id should be replaced with user_id

D. Policies cannot use AND conditions

Solution

1. Step 1: Understand the AND condition

   AND means both auth.uid() = owner_id and bucket_id = 'private' must be true for access.

2. Step 2: Identify why access fails

   If bucket_id is not exactly 'private' for some files, even owners cannot access them, causing the problem.

3. Final Answer:

   The policy blocks access because AND requires both conditions, but bucket_id might differ -> Option A

4. Quick Check:

   AND requires both true, bucket_id mismatch blocks access [OK]

Hint: AND means all conditions must match exactly [OK]

Common Mistakes:

• Thinking auth.uid() is invalid
• Assuming owner_id is wrong field
• Believing AND is not allowed in policies

5. You want to create a policy that allows users to delete only files they own in any bucket except the 'public' bucket. Which policy condition is correct?

hard

A. using (auth.uid() != owner_id AND bucket_id = 'public')

B. using (auth.uid() = owner_id OR bucket_id != 'public')

C. using (auth.uid() = owner_id AND bucket_id = 'public')

D. using (auth.uid() = owner_id AND bucket_id != 'public')

Solution

1. Step 1: Define the requirements

   Users can delete files only if they own them and the file is not in the 'public' bucket.

2. Step 2: Match the condition

   auth.uid() = owner_id ensures ownership; bucket_id != 'public' excludes the public bucket.

3. Final Answer:

   using (auth.uid() = owner_id AND bucket_id != 'public') -> Option D

4. Quick Check:

   Owner AND not public bucket = correct delete policy [OK]

Hint: Use AND to combine ownership and bucket exclusion [OK]

Common Mistakes:

• Using OR instead of AND allowing wrong deletes
• Checking for equality with 'public' instead of exclusion
• Mixing up != and = operators