Storage policies for access control in Supabase - Step-by-Step Execution

Process Flow - Storage policies for access control

User Request to Access Storage

↓

Check Storage Policy Rules

↓

Policy Allows

↓

Grant Access

↓

Return Result

When a user tries to access storage, Supabase checks the storage policies. If the policies allow access, it grants it; otherwise, access is denied.

Execution Sample

Supabase

create policy "Allow read if owner" on storage.objects
  for select using (auth.uid() = owner);

This policy allows users to read storage objects only if they own them.

Process Table

Step	User ID	Object Owner ID	Policy Condition (auth.uid() = owner)	Access Decision
1	user_123	user_123	True	Access Granted
2	user_456	user_123	False	Access Denied
3	user_789	user_789	True	Access Granted
4	user_123	user_456	False	Access Denied
5	user_456	user_456	True	Access Granted

💡 Access decisions are made based on whether the user's ID matches the object's owner ID.

Status Tracker

Variable	Start	After 1	After 2	After 3	After 4	After 5
User ID	N/A	user_123	user_456	user_789	user_123	user_456
Object Owner ID	N/A	user_123	user_123	user_789	user_456	user_456
Policy Condition	N/A	True	False	True	False	True
Access Decision	N/A	Access Granted	Access Denied	Access Granted	Access Denied	Access Granted

Key Moments - 2 Insights

Why is access denied when the user ID does not match the owner ID?

Because the policy condition auth.uid() = owner evaluates to False, so the policy denies access as shown in rows 2 and 4 of the execution table.

Can a user access an object they do not own if no policy allows it?

No, without a policy explicitly allowing access, the default is to deny, ensuring security by default.

Visual Quiz - 3 Questions

Look at the execution table, what is the access decision at step 3 when user ID is 'user_789' and owner ID is 'user_789'?

A Access Denied

B Access Granted

C Policy Not Evaluated

D Access Pending

💡 Hint

Check the 'Policy Condition' and 'Access Decision' columns at step 3 in the execution table.

At which step does the policy condition evaluate to False?

A Step 3

B Step 1

C Step 2

D Step 5

💡 Hint

Look at the 'Policy Condition' column in the execution table for False values.

If the policy condition changed to allow all users access, how would the access decision change at step 4?

A Access Granted

B Access Denied

C Policy Error

D No Change

💡 Hint

Consider that the policy condition would always be True, so access would be granted regardless of user and owner IDs.

Concept Snapshot

Storage policies control who can access storage objects.
Policies use conditions like auth.uid() = owner.
If condition is True, access is granted; else denied.
Default is deny if no policy matches.
Policies protect data by enforcing ownership rules.

Full Transcript

When a user requests access to storage in Supabase, the system checks storage policies. These policies have conditions, such as allowing access only if the user's ID matches the object's owner. If the condition is true, access is granted; if false, access is denied. For example, if user_123 tries to access an object owned by user_123, access is granted. But if user_456 tries to access that same object, access is denied. This ensures only owners can read their storage objects unless policies say otherwise. The default behavior is to deny access if no policy allows it, keeping data secure.

Practice

1. What is the main purpose of storage policies in Supabase?

easy

A. To increase storage space automatically

B. To speed up file uploads

C. To control who can read, upload, or delete files

D. To backup files to another server

Solution

1. Step 1: Understand storage policies

   Storage policies define rules about who can access or change files.

2. Step 2: Identify the main goal

   The main goal is to control access like reading, uploading, or deleting files to keep data safe.

3. Final Answer:

   To control who can read, upload, or delete files -> Option C

4. Quick Check:

   Storage policies = Access control [OK]

Hint: Storage policies = who can do what with files [OK]

Common Mistakes:

• Thinking policies increase storage size
• Confusing policies with backup features
• Believing policies speed up uploads

2. Which of the following is the correct syntax to allow only authenticated users to read files in Supabase storage policy?

easy

A. allow read if user.is_authenticated

B. using (auth.uid() != null)

C. check auth.user == true

D. permit read where auth.id exists

Solution

1. Step 1: Recall Supabase policy syntax

   Supabase uses SQL-like expressions with functions like auth.uid() to check user identity.

2. Step 2: Identify correct condition for authenticated users

   auth.uid() returns user ID if logged in, so checking auth.uid() != null allows only authenticated users.

3. Final Answer:

   using (auth.uid() != null) -> Option B

4. Quick Check:

   auth.uid() != null = authenticated user check [OK]

Hint: Use auth.uid() to check if user is logged in [OK]

Common Mistakes:

• Using incorrect property names like user.is_authenticated
• Writing non-SQL syntax like permit or allow keywords
• Checking auth.id instead of auth.uid()

3. Given this storage policy snippet:

using (bucket_id = 'public' OR auth.uid() = owner_id)

What does this policy allow?

medium

A. Anyone can access files in the 'public' bucket or owners can access their files

B. Only owners can access files in any bucket

C. Only users with bucket_id 'public' can access files

D. No one can access files unless they are owners

Solution

1. Step 1: Analyze the condition

   The condition allows access if bucket_id equals 'public' OR if the user's ID matches owner_id.

2. Step 2: Interpret the meaning

   This means anyone can access files in the 'public' bucket, and owners can access their own files in any bucket.

3. Final Answer:

   Anyone can access files in the 'public' bucket or owners can access their files -> Option A

4. Quick Check:

   bucket_id='public' OR auth.uid()=owner_id = public or owner access [OK]

Hint: OR means either public bucket or owner access allowed [OK]

Common Mistakes:

• Thinking only owners have access
• Assuming bucket_id restricts all access
• Ignoring the OR condition

4. You wrote this policy:

using (auth.uid() = owner_id AND bucket_id = 'private')

But users report they cannot read their private files. What is the likely problem?

medium

A. The policy blocks access because AND requires both conditions, but bucket_id might differ

B. auth.uid() is not a valid function

C. owner_id should be replaced with user_id

D. Policies cannot use AND conditions

Solution

1. Step 1: Understand the AND condition

   AND means both auth.uid() = owner_id and bucket_id = 'private' must be true for access.

2. Step 2: Identify why access fails

   If bucket_id is not exactly 'private' for some files, even owners cannot access them, causing the problem.

3. Final Answer:

   The policy blocks access because AND requires both conditions, but bucket_id might differ -> Option A

4. Quick Check:

   AND requires both true, bucket_id mismatch blocks access [OK]

Hint: AND means all conditions must match exactly [OK]

Common Mistakes:

• Thinking auth.uid() is invalid
• Assuming owner_id is wrong field
• Believing AND is not allowed in policies

5. You want to create a policy that allows users to delete only files they own in any bucket except the 'public' bucket. Which policy condition is correct?

hard

A. using (auth.uid() != owner_id AND bucket_id = 'public')

B. using (auth.uid() = owner_id OR bucket_id != 'public')

C. using (auth.uid() = owner_id AND bucket_id = 'public')

D. using (auth.uid() = owner_id AND bucket_id != 'public')

Solution

1. Step 1: Define the requirements

   Users can delete files only if they own them and the file is not in the 'public' bucket.

2. Step 2: Match the condition

   auth.uid() = owner_id ensures ownership; bucket_id != 'public' excludes the public bucket.

3. Final Answer:

   using (auth.uid() = owner_id AND bucket_id != 'public') -> Option D

4. Quick Check:

   Owner AND not public bucket = correct delete policy [OK]

Hint: Use AND to combine ownership and bucket exclusion [OK]

Common Mistakes:

• Using OR instead of AND allowing wrong deletes
• Checking for equality with 'public' instead of exclusion
• Mixing up != and = operators