Using auth.uid() in policies in Supabase - Step-by-Step Execution

Process Flow - Using auth.uid() in policies

Request arrives

↓

Policy checks auth.uid()

↓

Compare auth.uid() with record owner

↓

Allow

↓

Return data

When a request comes, the policy uses auth.uid() to get the user's ID, compares it to the record owner, and allows or denies access accordingly.

Execution Sample

Supabase

CREATE POLICY "Users can access their own data"
ON profiles
FOR SELECT
USING (auth.uid() = profiles.user_id);

This policy allows users to select rows from profiles only if their auth.uid() matches the user_id in the row.

Process Table

Step	Action	auth.uid()	Record user_id	Condition (auth.uid() = user_id)	Result
1	Request from user A	userA123	userA123	True	Allow access
2	Request from user B	userB456	userA123	False	Deny access
3	Request from user C	userC789	userC789	True	Allow access
4	Request from user D	userD000	userE111	False	Deny access

💡 Execution stops after condition check; access granted only if auth.uid() matches record owner.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4
auth.uid()	null	userA123	userB456	userC789	userD000
record user_id	null	userA123	userA123	userC789	userE111
condition result	null	True	False	True	False
access decision	null	Allow	Deny	Allow	Deny

Key Moments - 3 Insights

Why does a user get denied access even if they are logged in?

Because auth.uid() must exactly match the record's user_id. If they differ, as shown in step 2 and 4 of the execution_table, access is denied.

Can auth.uid() be used to access other users' data?

No. The policy explicitly compares auth.uid() to the record owner. Only matching IDs allow access, preventing cross-user data access.

What happens if auth.uid() is null or missing?

The condition fails because null does not equal any user_id, so access is denied by default.

Visual Quiz - 3 Questions

Look at the execution_table, what is the access decision at step 3 when auth.uid() is 'userC789' and record user_id is 'userC789'?

A Allow access

B Deny access

C Error

D Pending

💡 Hint

Check the 'Result' column at step 3 in the execution_table.

At which step does the condition auth.uid() = user_id evaluate to False?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Look at the 'Condition' column in the execution_table for False values.

If a new request comes with auth.uid() 'userF222' and record user_id 'userF222', what would be the access decision?

A Deny access

B Allow access

C Error

D Depends on other policies

💡 Hint

Refer to the pattern in the execution_table where matching auth.uid() and user_id results in Allow access.

Concept Snapshot

Using auth.uid() in policies:
- auth.uid() returns the current user's ID.
- Policies compare auth.uid() to record owner fields.
- Access is allowed only if IDs match.
- Prevents users from accessing others' data.
- Essential for row-level security in Supabase.

Full Transcript

When a request is made to access data, Supabase policies use auth.uid() to get the current user's ID. The policy then compares this ID to the user_id field in the data record. If they match, the policy allows access; if not, access is denied. This ensures users can only see their own data. For example, if userA123 requests data owned by userA123, access is granted. But if userB456 requests the same data, access is denied. This check happens for every request, enforcing row-level security automatically.

Practice

1.

What does auth.uid() represent in Supabase row-level security policies?

easy

A. The current logged-in user's unique ID

B. The database server's ID

C. The table's primary key

D. The user's email address

Solution

1. Step 1: Understand the purpose of auth.uid()

   auth.uid() is a function that returns the unique identifier of the currently logged-in user in Supabase.

2. Step 2: Identify what auth.uid() is not

   It does not return server or table IDs, nor user email addresses directly.

3. Final Answer:

   The current logged-in user's unique ID -> Option A

4. Quick Check:

   auth.uid() = current user ID [OK]

Hint: auth.uid() always means the logged-in user's ID [OK]

Common Mistakes:

• Thinking auth.uid() returns email
• Confusing auth.uid() with table keys
• Assuming auth.uid() is server ID

2.

Which of the following is the correct syntax to allow a user to select only their own rows in a table with a user_id column?

CREATE POLICY "Select own rows" ON my_table FOR SELECT USING ( ... );

easy

A. user_id = current_user()

B. auth.uid() = user_email

C. user_id == auth.uid()

D. user_id = auth.uid()

Solution

1. Step 1: Check correct equality operator in policies

   Supabase policies use single equals = for comparison, not double equals ==.

2. Step 2: Match user_id with auth.uid()

   The correct way is to compare the table's user_id column to auth.uid().

3. Final Answer:

   user_id = auth.uid() -> Option D

4. Quick Check:

   Use single = and compare user_id to auth.uid() [OK]

Hint: Use single = to compare user_id with auth.uid() [OK]

Common Mistakes:

• Using double equals == in policy
• Comparing auth.uid() to email column
• Using current_user() instead of auth.uid()

3.

Given this policy on orders table:

CREATE POLICY "Users can select own orders" ON orders FOR SELECT USING (user_id = auth.uid());

What happens if a user with auth.uid() = 'abc123' runs a query to select orders?

medium

A. They see only orders where user_id is 'abc123'

B. They see all orders regardless of user_id

C. They get a syntax error

D. They see no orders at all

Solution

1. Step 1: Understand the policy condition

   The policy allows selecting rows where user_id equals the current user's ID.

2. Step 2: Apply the policy to the user's query

   The user with ID 'abc123' will only see rows where user_id is 'abc123'.

3. Final Answer:

   They see only orders where user_id is 'abc123' -> Option A

4. Quick Check:

   Policy filters rows by user_id = auth.uid() [OK]

Hint: Policy filters rows to match auth.uid() user_id [OK]

Common Mistakes:

• Thinking user sees all rows
• Expecting syntax error from correct policy
• Assuming no rows are returned

4.

Identify the error in this policy that aims to restrict updates to a user's own rows:

CREATE POLICY "Update own rows" ON profiles FOR UPDATE USING (user_id = auth.uid);

medium

A. user_id should be user_email

B. Wrong operator, should use == instead of =

C. Missing parentheses after auth.uid

D. Policy name cannot have spaces

Solution

1. Step 1: Check the usage of auth.uid()

   auth.uid is a function and must be called with parentheses: auth.uid().

2. Step 2: Verify other parts of the policy

   The operator = is correct, user_id is the right column, and policy names can have spaces.

3. Final Answer:

   Missing parentheses after auth.uid -> Option C

4. Quick Check:

   auth.uid() needs parentheses to call function [OK]

Hint: Always call auth.uid() with parentheses [OK]

Common Mistakes:

• Forgetting () after auth.uid
• Using == instead of = in policies
• Changing user_id to email incorrectly

5.

You want to create a policy that allows users to update their own profile only if their email is verified. The profiles table has columns user_id and email_verified (boolean). Which policy condition correctly enforces this?

hard

A. email_verified = true

B. user_id = auth.uid() AND email_verified = true

C. auth.uid() = user_id AND email_verified = false

D. user_id = auth.uid() OR email_verified = true

Solution

1. Step 1: Combine user ownership and email verification

   The policy must check both that the row belongs to the user and that their email is verified.

2. Step 2: Use AND to require both conditions

   Using AND ensures both user_id = auth.uid() and email_verified = true must be true.

3. Final Answer:

   user_id = auth.uid() AND email_verified = true -> Option B

4. Quick Check:

   Use AND to combine user_id and email_verified checks [OK]

Hint: Use AND to require both user_id and email_verified true [OK]

Common Mistakes:

• Using OR instead of AND
• Checking email_verified = false
• Omitting user_id check