Supabase
RLS Policy Violation (403 Forbidden) Despite Correct User ID and Permissions #36243
YutaOkoshi
announced in
Troubleshooting
Replies: 11 comments
-
|
Supabase side log |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
@YutaOkoshi Cause So if your USING clause is Fix CREATE POLICY "Users can update their own ideas"
ON public.ideas
FOR UPDATE
USING (auth.uid() = user_uid)
WITH CHECK (true);This lets Postgres skip unnecessary re-checking of auth.uid() on fields that aren’t changing. |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
thanks, for your comment! |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
I was try ' WITH CHECK (true);'. but, it dosent work. SELECT * FROM pg_policies WHERE schemaname = 'public' AND tablename = 'ideas';Har file when request to supabase, |
Beta Was this translation helpful? Give feedback.
0 replies
-
API Gateway Log by supabae |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
I am kinda lost in this one, try relaxing the policy with something like ALTER POLICY "Users can update their own ideas"
ON public.ideas
FOR UPDATE
WITH CHECK (auth.uid() = user_uid); |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
@YutaOkoshi , does the thumbs up mean it worked? Im having the same problem. Along with a few other unlucky people on SO. |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
@Vaullti-KR No it did not work. Sounds like we have similar problems. |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
@YutaOkoshi https://discord.com/channels/839993398554656828/1369850239346802699 if the link doesn't work try searching in the supbase discord - 42501 permission denied, filter by date - posted yesterday. |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Hi all, I'm going to move this over as a discussion due to inactivity. Thanks for your help on this one! |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
That 42501 on an UPDATE is Postgres telling you the new-row check failed, and pulling the So confirm it from Postgres's side instead of the client's. Add a tiny function and call it with the exact same client you use for the create function public.whoami() returns table(uid uuid, jwt json)
language sql security invoker as $$ select auth.uid(), auth.jwt() $$;If I dug into every way |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Bug report
Hello Supabase Team,
I am encountering a persistent issue with Row Level Security (RLS) policies on my
ideastable, resulting in a403 Forbiddenerror (PostgREST error code42501:new row violates row-level security policy for table "ideas") when attempting toUPDATEa row (specifically, performing a logical delete by settingdeleted_at), even though all checks seem to pass.Context:
public.ideasPATCH /rest/v1/ideas?uid=eq.<idea_uid>(from Supabase JS clientupdatemethod) to setdeleted_at = NOW().uid = '1b046deb-76ec-8168-afa8-f5364f00e612',user_uid = 'd1dc7a43-6a95-426f-9c3c-144742edef9f'auth.uid() = 'd1dc7a43-6a95-426f-9c3c-144742edef9f'Troubleshooting Steps Taken:
supabaseClient.auth.getUser()right before theupdatecall, confirming the client is authenticated with the correct user ID (d1dc7a43-...).PATCHrequest headers in browser dev tools. TheAuthorization: Bearer <token>header is present, and the JWT payload correctly contains"sub": "d1dc7a43-...". The token is valid.uid = '1b046deb-...') in theideastable indeed hasuser_uid = 'd1dc7a43-...'.information_schema.role_table_grantsthat theauthenticatedrole hasUPDATEprivileges on thepublic.ideastable.UPDATEpolicy had bothUSING (auth.uid() = user_uid)andWITH CHECK (auth.uid() = user_uid). The403error occurred.UPDATEpolicy to remove theWITH CHECKclause, leaving onlyUSING (auth.uid() = user_uid). The403 Forbiddenerror still persists even with this simplified policy.pg_policies-INSERThasWITH CHECK (auth.uid() = user_uid),SELECThasUSING (((auth.uid() = user_uid) OR (shared = true)) AND (deleted_at IS NULL)). No other potentially conflicting policies found.BEFORE UPDATEto setupdated_at = NOW(). This trigger does not modifyuser_uid.ideastable.Current RLS Policies on
public.ideas:[ { "schemaname": "public", "tablename": "ideas", "policyname": "Users can only create their own ideas", "permissive": "PERMISSIVE", "roles": "{public}", "cmd": "INSERT", "qual": null, "with_check": "(auth.uid() = user_uid)" }, { "schemaname": "public", "tablename": "ideas", "policyname": "Users can only update their own ideas (no check)", // Note: WITH CHECK removed "permissive": "PERMISSIVE", "roles": "{public}", "cmd": "UPDATE", "qual": "(auth.uid() = user_uid)", // USING clause "with_check": null // No WITH CHECK }, { "schemaname": "public", "tablename": "ideas", "policyname": "Users can view their own non-deleted ideas and shared non-delet", "permissive": "PERMISSIVE", "roles": "{public}", "cmd": "SELECT", "qual": "(((auth.uid() = user_uid) OR (shared = true)) AND (deleted_at IS NULL))", "with_check": null } ]Problem Summary:
Despite verifying client authentication, token validity, data integrity, table permissions, and simplifying the RLS
UPDATEpolicy to onlyUSING (auth.uid() = user_uid), the operation is still blocked by RLS (403 Forbidden, code42501). This suggests a potential issue within the Supabase backend regarding howauth.uid()is evaluated or compared in theUSINGclause for this specificUPDATEoperation.Could you please investigate why the RLS policy might be failing even when all apparent conditions are met?
Thank you for your assistance.
System information
Screenshots
If applicable, add screenshots to help explain your problem.
Additional context
Add any other context about the problem here.
Beta Was this translation helpful? Give feedback.
All reactions