How do I solve the issue (new row violates row-level security policy for table "products")?

[ict-biocare]

I'm trying to upload an image to Supabase in the 'products' bucket but it keeps showing this alert.
I have already created policies to handle the CRUD functions but the alert keeps popping up.
How do I solve this issue??

[trankhacvy]

@ict-biocare can you share your RLS of products table?

[ict-biocare]

Hi @trankhacvy, I have only created a RLS for the products bucket.
Here it is:

(bucket_id = 'products':: text)

Do I also need a RLS for the table?

[trankhacvy]

@ict-biocare No, it depends on your business logic.
Can you try to create RLS rules on storage.objects table. Refer to this example:
https://supabase.io/docs/guides/storage#allow-public-access-to-a-bucket

[satyaprakash-yadav]

code: '42501',
details: null,
hint: null,
message: 'new row violates row-level security policy for table "products"' i have this type of error in supabase can anyone resolved this issue plz, also i attached below screenshot rls policy
![Screenshot 2024-05-31 144858]
(https://github.com/supabase/supabase/assets/94888678/d9fc94dd-e1bd-4bd9-8551-cdf85242197f)

[anil-zenollect]

I am getting the same issue

[euphydev]

you should add 2 policies, INSERT and SELECT

[RezaHoque]

this worked for me.

[solvionsolutions]

Yeah, a storage upload is just an INSERT into storage.objects under the hood, so RLS treats it exactly like any table write — and a lone condition like bucket_id = 'products' won't authorize it unless it's attached to the INSERT command as a WITH CHECK. INSERT policies are evaluated against WITH CHECK, not USING, so if the policy you added only has a USING expression (or the CRUD policies got created as SELECT-only), every upload gets default-denied even though it looks covered. Add an explicit insert policy on storage.objects scoped to the authenticated role:

create policy "authenticated can upload to products"
on storage.objects for insert to authenticated
with check (bucket_id = 'products');

If you read the file back right after uploading (or the client lists it), add a matching select policy with using (bucket_id = 'products'), otherwise the read fails the same way. Worth double-checking the target role too — if the policy is set to anon/public but you're uploading as a signed-in user, it never matches. The mental model that trips everyone up: once RLS is on, nothing is permitted until a policy explicitly allows it, per command.

I wrote up the full breakdown of this error here: https://www.guardlayer.io/blog/supabase-new-row-violates-rls-policy