RLS Policy Violation (403 Forbidden) Despite Correct User ID and Permissions

[YutaOkoshi]

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Hello Supabase Team,

I am encountering a persistent issue with Row Level Security (RLS) policies on my ideas table, resulting in a 403 Forbidden error (PostgREST error code 42501: new row violates row-level security policy for table "ideas") when attempting to UPDATE a row (specifically, performing a logical delete by setting deleted_at), even though all checks seem to pass.

Context:

• Table: public.ideas
• Operation: PATCH /rest/v1/ideas?uid=eq.<idea_uid> (from Supabase JS client update method) to set deleted_at = NOW().
• Target Row: uid = '1b046deb-76ec-8168-afa8-f5364f00e612', user_uid = 'd1dc7a43-6a95-426f-9c3c-144742edef9f'
• Authenticated User: auth.uid() = 'd1dc7a43-6a95-426f-9c3c-144742edef9f'

Troubleshooting Steps Taken:

1. Client-Side Authentication Verified: Used supabaseClient.auth.getUser() right before the update call, confirming the client is authenticated with the correct user ID (d1dc7a43-...).
2. Request Headers Verified: Inspected the PATCH request headers in browser dev tools. The Authorization: Bearer <token> header is present, and the JWT payload correctly contains "sub": "d1dc7a43-...". The token is valid.
3. Data Integrity Verified: Confirmed that the target row (uid = '1b046deb-...') in the ideas table indeed has user_uid = 'd1dc7a43-...'.
4. Table Permissions Verified: Confirmed using information_schema.role_table_grants that the authenticated role has UPDATE privileges on the public.ideas table.
5. RLS Policy Simplified (UPDATE):
   • Initially, the UPDATE policy had both USING (auth.uid() = user_uid) and WITH CHECK (auth.uid() = user_uid). The 403 error occurred.
   • Crucially, I modified the UPDATE policy to remove the WITH CHECK clause, leaving only USING (auth.uid() = user_uid). The 403 Forbidden error still persists even with this simplified policy.
6. Other RLS Policies: Checked pg_policies - INSERT has WITH CHECK (auth.uid() = user_uid), SELECT has USING (((auth.uid() = user_uid) OR (shared = true)) AND (deleted_at IS NULL)). No other potentially conflicting policies found.
7. Triggers: Only have a standard trigger BEFORE UPDATE to set updated_at = NOW(). This trigger does not modify user_uid.
8. Database Webhooks/Functions: No webhooks or functions are triggered by updates on the ideas table.

Current RLS Policies on public.ideas:

[
  {
    "schemaname": "public",
    "tablename": "ideas",
    "policyname": "Users can only create their own ideas",
    "permissive": "PERMISSIVE",
    "roles": "{public}",
    "cmd": "INSERT",
    "qual": null,
    "with_check": "(auth.uid() = user_uid)"
  },
  {
    "schemaname": "public",
    "tablename": "ideas",
    "policyname": "Users can only update their own ideas (no check)", // Note: WITH CHECK removed
    "permissive": "PERMISSIVE",
    "roles": "{public}",
    "cmd": "UPDATE",
    "qual": "(auth.uid() = user_uid)", // USING clause
    "with_check": null // No WITH CHECK
  },
  {
    "schemaname": "public",
    "tablename": "ideas",
    "policyname": "Users can view their own non-deleted ideas and shared non-delet",
    "permissive": "PERMISSIVE",
    "roles": "{public}",
    "cmd": "SELECT",
    "qual": "(((auth.uid() = user_uid) OR (shared = true)) AND (deleted_at IS NULL))",
    "with_check": null
  }
]

Problem Summary:

Despite verifying client authentication, token validity, data integrity, table permissions, and simplifying the RLS UPDATE policy to only USING (auth.uid() = user_uid), the operation is still blocked by RLS (403 Forbidden, code 42501). This suggests a potential issue within the Supabase backend regarding how auth.uid() is evaluated or compared in the USING clause for this specific UPDATE operation.

Could you please investigate why the RLS policy might be failing even when all apparent conditions are met?

Thank you for your assistance.

System information

• OS: macOS 15.3.2（24D81）
• package.json
  • "@supabase/supabase-js": "^2.47.10",
  • @supabase/auth-helpers-nextjs@0.10.0
  • "next": "^14.2.8",
• Node.js Version18.x
• Browser: Arn
  • Version1.91.0 (61725)
  • Chromium Engine Version 135.0.7049.96

Screenshots

If applicable, add screenshots to help explain your problem.

Additional context

Add any other context about the problem here.

[YutaOkoshi]

Supabase side log

{
  "event_message": "PATCH | 403 | xxxxxx | 9332fe0bad0dd740 | https://mzrznnffhamnioisgfpa.supabase.co/rest/v1/ideas?uid=eq.1b046deb-76ec-8168-afa8-f5364f00e612 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36",
  "id": "bb6388d3-01c7-492b-927b-7c1ac938c414",
  "metadata": [
    {
      "load_balancer_experimental_routing": null,
      "load_balancer_geo_aware_info": [],
      "load_balancer_redirect_identifier": null,
      "logflare_worker": [
        {
          "worker_id": "YXMQEQ"
        }
      ],
      "request": [
        {
          "cf": [
            {
              "asOrganization": "au one net",
              "asn": xxxx,
              "botManagement": [
                {
                  "corporateProxy": false,
                  "detectionIds": [],
                  "ja3Hash": null,
                  "jsDetection": [
                    {
                      "passed": false
                    }
                  ],
                  "score": 99,
                  "staticResource": false,
                  "verifiedBot": false
                }
              ],
              "city": "xxxxxx",
              "clientAcceptEncoding": "gzip, deflate, br, zstd",
              "clientTcpRtt": null,
              "clientTrustScore": null,
              "colo": "NRT",
              "continent": "AS",
              "country": "JP",
              "edgeRequestKeepAliveStatus": 1,
              "httpProtocol": "HTTP/3",
              "isEUCountry": null,
              "latitude": "12341",
              "longitude": "12341",
              "metroCode": null,
              "postalCode": "1234",
              "region": "asdf",
              "regionCode": "11",
              "requestPriority": null,
              "timezone": "Asia/Tokyo",
              "tlsCipher": "xxxxx",
              "tlsClientAuth": [
                {
                  "certPresented": "0",
                  "certRevoked": "0",
                  "certVerified": "NONE"
                }
              ],
              "tlsClientExtensionsSha1": "xxxx/xxxx=",
              "tlsClientHelloLength": "2011",
              "tlsClientRandom": "xxxxx+5IxVYZeSM+s=",
              "tlsExportedAuthenticator": [
                {
                  "clientFinished": "xxxxx",
                  "clientHandshake": "xxxxx",
                  "serverFinished": "xxxxx",
                  "serverHandshake": "xxxxxx"
                }
              ],
              "tlsVersion": "TLSv1.3",
              "verifiedBotCategory": null
            }
          ],
          "headers": [
            {
              "accept": "*/*",
              "cf_cache_status": null,
              "cf_connecting_ip": "xxxxxxxxx",
              "cf_ipcountry": "xxxxxx",
              "cf_ray": "xxxxxxxxx",
              "content_length": "41",
              "content_location": null,
              "content_range": null,
              "content_type": "application/json",
              "date": null,
              "host": "mzrznnffhamnioisgfpa.supabase.co",
              "prefer": null,
              "range": null,
              "referer": "xxxxxxxxxxx",
              "sb_gateway_mode": null,
              "sb_gateway_version": null,
              "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36",
              "x_client_info": "@supabase/auth-helpers-nextjs@0.10.0",
              "x_forwarded_host": null,
              "x_forwarded_proto": "https",
              "x_forwarded_user_agent": null,
              "x_kong_proxy_latency": null,
              "x_kong_upstream_latency": null,
              "x_real_ip": "xxxxxxxxx"
            }
          ],
          "host": "mzrznnffhamnioisgfpa.supabase.co",
          "method": "PATCH",
          "path": "/rest/v1/ideas",
          "port": null,
          "protocol": "https:",
          "sb": [
            {
              "apikey": [],
              "auth_user": "d1dc7a43-6a95-426f-9c3c-144742edef9f",
              "jwt": [
                {
                  "apikey": [
                    {
                      "invalid": null,
                      "payload": [
                        {
                          "algorithm": "HS256",
                          "expires_at": xxxxxxx,
                          "issuer": "supabase",
                          "role": "anon",
                          "signature_prefix": "aOv68M",
                          "subject": null
                        }
                      ]
                    }
                  ],
                  "authorization": [
                    {
                      "invalid": null,
                      "payload": [
                        {
                          "algorithm": "HS256",
                          "expires_at": xxxxxx,
                          "issuer": "https://mzrznnffhamnioisgfpa.supabase.co/auth/v1",
                          "key_id": "xxxxx+po8",
                          "role": "authenticated",
                          "session_id": "xxxxxxxxx",
                          "signature_prefix": "Oqqn3z",
                          "subject": "d1dc7a43-6a95-426f-9c3c-144742edef9f"
                        }
                      ]
                    }
                  ]
                }
              ]
            }
          ],
          "search": "?uid=eq.1b046deb-76ec-8168-afa8-f5364f00e612",
          "url": "https://mzrznnffhamnioisgfpa.supabase.co/rest/v1/ideas?uid=eq.1b046deb-76ec-8168-afa8-f5364f00e612"
        }
      ],
      "response": [
        {
          "headers": [
            {
              "cf_cache_status": "DYNAMIC",
              "cf_ray": "xxxxxxx-NRT",
              "content_length": null,
              "content_location": null,
              "content_range": null,
              "content_type": "application/json; charset=utf-8",
              "date": "Sun, 20 Apr 2025 07:40:14 GMT",
              "sb_gateway_mode": null,
              "sb_gateway_version": "1",
              "transfer_encoding": "chunked",
              "x_kong_proxy_latency": null,
              "x_kong_upstream_latency": null,
              "x_sb_error_code": null
            }
          ],
          "origin_time": 391,
          "status_code": 403
        }
      ]
    }
  ],
  "timestamp": 1745134814426000
}

[iambnlvn]

@YutaOkoshi
Hey there 👋 just jumping in as a someone who ran into the exact same issue.

Cause
PostgREST will implicitly add a WITH CHECK clause (even if you don’t define one), and it appears to evaluate it against the new row.

So if your USING clause is auth.uid() = user_uid, but there's no explicit WITH CHECK, PostgREST applies the same condition to the new row. That can cause problems even if you're not updating user_uid — for example, when doing a logical delete (deleted_at = now()).

Fix
Explicitly defining WITH CHECK (true) in your policy prevents PostgREST from trying to validate the new row’s user_uid value:

CREATE POLICY "Users can update their own ideas"
  ON public.ideas
  FOR UPDATE
  USING (auth.uid() = user_uid)
  WITH CHECK (true);

This lets Postgres skip unnecessary re-checking of auth.uid() on fields that aren’t changing.

[YutaOkoshi]

thanks, for your comment!
I'll check back over the weekend and share the results.

[YutaOkoshi]

I was try ' WITH CHECK (true);'. but, it dosent work.
How do I isolate the problem from here?

SELECT * FROM pg_policies WHERE schemaname = 'public' AND tablename = 'ideas';

[
  {
    "schemaname": "public",
    "tablename": "ideas",
    "policyname": "Users can only create their own ideas",
    "permissive": "PERMISSIVE",
    "roles": "{public}",
    "cmd": "INSERT",
    "qual": null,
    "with_check": "(auth.uid() = user_uid)"
  },
  {
    "schemaname": "public",
    "tablename": "ideas",
    "policyname": "Users can update their own ideas",
    "permissive": "PERMISSIVE",
    "roles": "{public}",
    "cmd": "UPDATE",
    "qual": "(auth.uid() = user_uid)",
    "with_check": "true"
  },
  {
    "schemaname": "public",
    "tablename": "ideas",
    "policyname": "Users can view their own non-deleted ideas and shared non-delet",
    "permissive": "PERMISSIVE",
    "roles": "{public}",
    "cmd": "SELECT",
    "qual": "(((auth.uid() = user_uid) OR (shared = true)) AND (deleted_at IS NULL))",
    "with_check": null
  }
]

Har file when request to supabase,

{
  "log": {
    "version": "1.2",
    "creator": {
      "name": "WebInspector",
      "version": "537.36"
    },
    "pages": [
      {
        "startedDateTime": "2025-04-27T07:48:02.870Z",
        "id": "page_1",
        "title": "https://vd-example.org/ja",
        "pageTimings": {
          "onContentLoad": 636.490999997477,
          "onLoad": 780.2999999985332
        }
      }
    ],
    "entries": [
      {
        "_connectionId": "460720",
        "_initiator": {
          "type": "script",
          "stack": {
            "callFrames": [
              {
                "functionName": "",
                "scriptId": "143",
                "url": "https://vd-example.org/_next/static/chunks/pages/_app-c11665e8a60e592f.js",
                "lineNumber": 5,
                "columnNumber": 19620
              },
              {
                "functionName": "u",
                "scriptId": "143",
                "url": "https://vd-example.org/_next/static/chunks/pages/_app-c11665e8a60e592f.js",
                "lineNumber": 5,
                "columnNumber": 19975
              },
              {
                "functionName": "r",
                "scriptId": "143",
                "url": "https://vd-example.org/_next/static/chunks/pages/_app-c11665e8a60e592f.js",
                "lineNumber": 5,
                "columnNumber": 20084
              }
            ],
            "parent": {
              "description": "Promise.then",
              "callFrames": [
                {
                  "functionName": "s",
                  "scriptId": "143",
                  "url": "https://vd-example.org/_next/static/chunks/pages/_app-c11665e8a60e592f.js",
                  "lineNumber": 5,
                  "columnNumber": 20246
                },
                {
                  "functionName": "",
                  "scriptId": "143",
                  "url": "https://vd-example.org/_next/static/chunks/pages/_app-c11665e8a60e592f.js",
                  "lineNumber": 5,
                  "columnNumber": 20256
                },
                {
                  "functionName": "",
                  "scriptId": "143",
                  "url": "https://vd-example.org/_next/static/chunks/pages/_app-c11665e8a60e592f.js",
                  "lineNumber": 5,
                  "columnNumber": 20028
                },
                {
                  "functionName": "then",
                  "scriptId": "143",
                  "url": "https://vd-example.org/_next/static/chunks/pages/_app-c11665e8a60e592f.js",
                  "lineNumber": 0,
                  "columnNumber": 11926
                }
              ]
            }
          }
        },
        "_priority": "High",
        "_resourceType": "fetch",
        "cache": {},
        "connection": "443",
        "pageref": "page_1",
        "request": {
          "method": "PATCH",
          "url": "https://mzrznnffhamnioisgfpa.supabase.co/rest/v1/ideas?uid=eq.1b046deb-76ec-8194-aee7-e3fcd6df209f",
          "httpVersion": "h3",
          "headers": [
            {
              "name": ":authority",
              "value": "mzrznnffhamnioisgfpa.supabase.co"
            },
            {
              "name": ":method",
              "value": "PATCH"
            },
            {
              "name": ":path",
              "value": "/rest/v1/ideas?uid=eq.1b046deb-76ec-8194-aee7-e3fcd6df209f"
            },
            {
              "name": ":scheme",
              "value": "https"
            },
            {
              "name": "accept",
              "value": "*/*"
            },
            {
              "name": "accept-encoding",
              "value": "gzip, deflate, br, zstd"
            },
            {
              "name": "accept-language",
              "value": "ja,en-US;q=0.9,en;q=0.8"
            },
            {
              "name": "apikey",
              "value": "xxxxxxxxxxx"
            },
            {
              "name": "content-length",
              "value": "41"
            },
            {
              "name": "content-profile",
              "value": "public"
            },
            {
              "name": "content-type",
              "value": "application/json"
            },
            {
              "name": "dnt",
              "value": "1"
            },
            {
              "name": "origin",
              "value": "https://vd-example.org"
            },
            {
              "name": "prefer",
              "value": ""
            },
            {
              "name": "priority",
              "value": "u=1, i"
            },
            {
              "name": "referer",
              "value": "https://vd-example.org/"
            },
            {
              "name": "sec-ch-ua",
              "value": "\"Chromium\";v=\"135\", \"Not-A.Brand\";v=\"8\""
            },
            {
              "name": "sec-ch-ua-mobile",
              "value": "?0"
            },
            {
              "name": "sec-ch-ua-platform",
              "value": "\"macOS\""
            },
            {
              "name": "sec-fetch-dest",
              "value": "empty"
            },
            {
              "name": "sec-fetch-mode",
              "value": "cors"
            },
            {
              "name": "sec-fetch-site",
              "value": "cross-site"
            },
            {
              "name": "user-agent",
              "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
            },
            {
              "name": "x-client-info",
              "value": "@supabase/auth-helpers-nextjs@0.10.0"
            }
          ],
          "queryString": [
            {
              "name": "uid",
              "value": "eq.1b046deb-76ec-8194-aee7-e3fcd6df209f"
            }
          ],
          "cookies": [],
          "headersSize": -1,
          "bodySize": 41,
          "postData": {
            "mimeType": "application/json",
            "text": "{\"deleted_at\":\"2025-04-27T07:48:24.938Z\"}"
          }
        },
        "response": {
          "status": 403,
          "statusText": "",
          "httpVersion": "h3",
          "headers": [
            {
              "name": "access-control-allow-credentials",
              "value": "true"
            },
            {
              "name": "access-control-allow-origin",
              "value": "https://vd-example.org"
            },
            {
              "name": "access-control-expose-headers",
              "value": "Content-Encoding, Content-Location, Content-Range, Content-Type, Date, Location, Server, Transfer-Encoding, Range-Unit"
            },
            {
              "name": "alt-svc",
              "value": "h3=\":443\"; ma=86400"
            },
            {
              "name": "cf-cache-status",
              "value": "DYNAMIC"
            },
            {
              "name": "cf-ray",
              "value": "936cb7a88b4de01d-NRT"
            },
            {
              "name": "content-encoding",
              "value": "gzip"
            },
            {
              "name": "content-type",
              "value": "application/json; charset=utf-8"
            },
            {
              "name": "date",
              "value": "Sun, 27 Apr 2025 07:48:25 GMT"
            },
            {
              "name": "priority",
              "value": "u=1,i"
            },
            {
              "name": "sb-gateway-version",
              "value": "1"
            },
            {
              "name": "sb-project-ref",
              "value": "mzrznnffhamnioisgfpa"
            },
            {
              "name": "server",
              "value": "cloudflare"
            },
            {
              "name": "server-timing",
              "value": "cfExtPri"
            },
            {
              "name": "strict-transport-security",
              "value": "max-age=31536000; includeSubDomains; preload"
            },
            {
              "name": "vary",
              "value": "Accept-Encoding"
            },
            {
              "name": "x-content-type-options",
              "value": "nosniff"
            },
            {
              "name": "x-envoy-attempt-count",
              "value": "1"
            },
            {
              "name": "x-envoy-upstream-service-time",
              "value": "26"
            }
          ],
          "cookies": [],
          "content": {
            "size": 118,
            "mimeType": "application/json",
            "text": "{\"code\":\"42501\",\"details\":null,\"hint\":null,\"message\":\"new row violates row-level security policy for table \\\"ideas\\\"\"}"
          },
          "redirectURL": "",
          "headersSize": -1,
          "bodySize": -1,
          "_transferSize": 550,
          "_error": null,
          "_fetchedViaServiceWorker": false
        },
        "serverIPAddress": "xxx.xxx.xxx.xxx",
        "startedDateTime": "2025-04-27T07:48:24.966Z",
        "time": 152.54599999752827,
        "timings": {
          "blocked": 48.90899999247771,
          "dns": -1,
          "ssl": -1,
          "connect": -1,
          "send": 0.39800000000000013,
          "wait": 101.8099999942202,
          "receive": 1.4290000108303502,
          "_blocked_queueing": 47.64799999247771,
          "_workerStart": -1,
          "_workerReady": -1,
          "_workerFetchStart": -1,
          "_workerRespondWithSettled": -1
        }
      },
      {
        "_connectionId": "460720",
        "_initiator": {
          "type": "preflight",
          "url": "https://mzrznnffhamnioisgfpa.supabase.co/rest/v1/ideas?uid=eq.1b046deb-76ec-8194-aee7-e3fcd6df209f",
          "requestId": "14979.200"
        },
        "_priority": "High",
        "_resourceType": "preflight",
        "cache": {},
        "connection": "443",
        "pageref": "page_1",
        "request": {
          "method": "OPTIONS",
          "url": "https://mzrznnffhamnioisgfpa.supabase.co/rest/v1/ideas?uid=eq.1b046deb-76ec-8194-aee7-e3fcd6df209f",
          "httpVersion": "h3",
          "headers": [
            {
              "name": ":authority",
              "value": "mzrznnffhamnioisgfpa.supabase.co"
            },
            {
              "name": ":method",
              "value": "OPTIONS"
            },
            {
              "name": ":path",
              "value": "/rest/v1/ideas?uid=eq.1b046deb-76ec-8194-aee7-e3fcd6df209f"
            },
            {
              "name": ":scheme",
              "value": "https"
            },
            {
              "name": "accept",
              "value": "*/*"
            },
            {
              "name": "accept-encoding",
              "value": "gzip, deflate, br, zstd"
            },
            {
              "name": "accept-language",
              "value": "ja,en-US;q=0.9,en;q=0.8"
            },
            {
              "name": "access-control-request-headers",
              "value": "apikey,authorization,content-profile,content-type,prefer,x-client-info"
            },
            {
              "name": "access-control-request-method",
              "value": "PATCH"
            },
            {
              "name": "origin",
              "value": "https://vd-example.org"
            },
            {
              "name": "priority",
              "value": "u=1, i"
            },
            {
              "name": "referer",
              "value": "https://vd-example.org/"
            },
            {
              "name": "sec-fetch-dest",
              "value": "empty"
            },
            {
              "name": "sec-fetch-mode",
              "value": "cors"
            },
            {
              "name": "sec-fetch-site",
              "value": "cross-site"
            },
            {
              "name": "user-agent",
              "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
            }
          ],
          "queryString": [
            {
              "name": "uid",
              "value": "eq.1b046deb-76ec-8194-aee7-e3fcd6df209f"
            }
          ],
          "cookies": [],
          "headersSize": -1,
          "bodySize": 0
        },
        "response": {
          "status": 200,
          "statusText": "",
          "httpVersion": "h3",
          "headers": [
            {
              "name": "access-control-allow-headers",
              "value": "apikey,authorization,content-profile,content-type,prefer,x-client-info"
            },
            {
              "name": "access-control-allow-methods",
              "value": "GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT"
            },
            {
              "name": "access-control-allow-origin",
              "value": "*"
            },
            {
              "name": "access-control-max-age",
              "value": "3600"
            },
            {
              "name": "alt-svc",
              "value": "h3=\":443\"; ma=86400"
            },
            {
              "name": "cf-ray",
              "value": "936cb7a83adde01d-NRT"
            },
            {
              "name": "content-length",
              "value": "0"
            },
            {
              "name": "date",
              "value": "Sun, 27 Apr 2025 07:48:25 GMT"
            },
            {
              "name": "priority",
              "value": "u=1,i"
            },
            {
              "name": "sb-project-ref",
              "value": "mzrznnffhamnioisgfpa"
            },
            {
              "name": "server",
              "value": "cloudflare"
            },
            {
              "name": "server-timing",
              "value": "cfExtPri"
            },
            {
              "name": "strict-transport-security",
              "value": "max-age=31536000; includeSubDomains; preload"
            },
            {
              "name": "vary",
              "value": "Accept-Encoding"
            },
            {
              "name": "x-content-type-options",
              "value": "nosniff"
            }
          ],
          "cookies": [],
          "content": {
            "size": 0,
            "mimeType": "x-unknown"
          },
          "redirectURL": "",
          "headersSize": -1,
          "bodySize": -1,
          "_transferSize": 0,
          "_error": null,
          "_fetchedViaServiceWorker": false
        },
        "serverIPAddress": "xxx.xxx.xxx.xxx",
        "startedDateTime": "2025-04-27T07:48:24.967Z",
        "time": 46.085999987553805,
        "timings": {
          "blocked": 2.4119999923314897,
          "dns": -1,
          "ssl": -1,
          "connect": -1,
          "send": 0.6950000000000001,
          "wait": 41.979999998995105,
          "receive": 0.9989999962272123,
          "_blocked_queueing": 0.9659999923314899,
          "_workerStart": -1,
          "_workerReady": -1,
          "_workerFetchStart": -1,
          "_workerRespondWithSettled": -1
        }
      }
    ]
  }
}

[YutaOkoshi]

API Gateway Log by supabae

{
  "event_message": "PATCH | 403 | xxx.xxx.xxx.xx | 936cb7a88b4de01d | https://mzrznnffhamnioisgfpa.supabase.co/rest/v1/ideas?uid=eq.1b046deb-76ec-8194-aee7-e3fcd6df209f | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36",
  "id": "74cd171d-79f9-43ff-ab81-81e7c2cde53b",
  "metadata": [
    {
      "load_balancer_experimental_routing": null,
      "load_balancer_geo_aware_info": [],
      "load_balancer_redirect_identifier": null,
      "logflare_worker": [
        {
          "worker_id": "7C411M"
        }
      ],
      "request": [
        {
          "cf": [
            {
              "asOrganization": "au one net",
              "asn": 2516,
              "botManagement": [
                {
                  "corporateProxy": false,
                  "detectionIds": [],
                  "ja3Hash": null,
                  "jsDetection": [
                    {
                      "passed": false
                    }
                  ],
                  "score": 99,
                  "staticResource": false,
                  "verifiedBot": false
                }
              ],
              "city": "xxx",
              "clientAcceptEncoding": "gzip, deflate, br, zstd",
              "clientTcpRtt": null,
              "clientTrustScore": null,
              "colo": "xxxx",
              "continent": "xxxx",
              "country": "xxxx",
              "edgeRequestKeepAliveStatus": 1,
              "httpProtocol": "HTTP/3",
              "isEUCountry": null,
              "latitude": "xxxx",
              "longitude": "xxxx",
              "metroCode": null,
              "postalCode": "xxxx",
              "region": "xxxx",
              "regionCode": "xxxx",
              "requestPriority": null,
              "timezone": "xxxx",
              "tlsCipher": "xxxx",
              "tlsClientAuth": [
                {
                  "certPresented": "0",
                  "certRevoked": "0",
                  "certVerified": "NONE"
                }
              ],
              "tlsClientExtensionsSha1": "ouz+xxxx=",
              "tlsClientHelloLength": "2042",
              "tlsClientRandom": "J/xxxx/IsSSLK0BT/RKtzs=",
              "tlsExportedAuthenticator": [
                {
                  "clientFinished": "xxxx",
                  "clientHandshake": "xxxx",
                  "serverFinished": "xxxx",
                  "serverHandshake": "xxxx"
                }
              ],
              "tlsVersion": "TLSv1.3",
              "verifiedBotCategory": null
            }
          ],
          "headers": [
            {
              "accept": "*/*",
              "cf_cache_status": null,
              "cf_connecting_ip": "xxx.xxx.xxx.xx",
              "cf_ipcountry": "JP",
              "cf_ray": "936cb7a88b4de01d",
              "content_length": "41",
              "content_location": null,
              "content_range": null,
              "content_type": "application/json",
              "date": null,
              "host": "mzrznnffhamnioisgfpa.supabase.co",
              "prefer": null,
              "range": null,
              "referer": "https://vd-example.org/",
              "sb_gateway_mode": null,
              "sb_gateway_version": null,
              "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36",
              "x_client_info": "@supabase/auth-helpers-nextjs@0.10.0",
              "x_forwarded_host": null,
              "x_forwarded_proto": "https",
              "x_forwarded_user_agent": null,
              "x_kong_proxy_latency": null,
              "x_kong_upstream_latency": null,
              "x_real_ip": "xxx.xxx.xxx.xx"
            }
          ],
          "host": "mzrznnffhamnioisgfpa.supabase.co",
          "method": "PATCH",
          "path": "/rest/v1/ideas",
          "port": null,
          "protocol": "https:",
          "sb": [
            {
              "apikey": [],
              "auth_user": "d1dc7a43-6a95-426f-9c3c-144742edef9f",
              "jwt": [
                {
                  "apikey": [
                    {
                      "invalid": null,
                      "payload": [
                        {
                          "algorithm": "HS256",
                          "expires_at": 1992989975,
                          "issuer": "supabase",
                          "role": "anon",
                          "signature_prefix": "aOv68M",
                          "subject": null
                        }
                      ]
                    }
                  ],
                  "authorization": [
                    {
                      "invalid": null,
                      "payload": [
                        {
                          "algorithm": "HS256",
                          "expires_at": 1745743632,
                          "issuer": "https://mzrznnffhamnioisgfpa.supabase.co/auth/v1",
                          "key_id": "ICCXQW1sOl3U+po8",
                          "role": "authenticated",
                          "session_id": "098fbbea-eb49-4310-9304-dec2d75e1552",
                          "signature_prefix": "iSx0EW",
                          "subject": "d1dc7a43-6a95-426f-9c3c-144742edef9f"
                        }
                      ]
                    }
                  ]
                }
              ]
            }
          ],
          "search": "?uid=eq.1b046deb-76ec-8194-aee7-e3fcd6df209f",
          "url": "https://mzrznnffhamnioisgfpa.supabase.co/rest/v1/ideas?uid=eq.1b046deb-76ec-8194-aee7-e3fcd6df209f"
        }
      ],
      "response": [
        {
          "headers": [
            {
              "cf_cache_status": "DYNAMIC",
              "cf_ray": "936cb7a8a310e01d-NRT",
              "content_length": null,
              "content_location": null,
              "content_range": null,
              "content_type": "application/json; charset=utf-8",
              "date": "Sun, 27 Apr 2025 07:48:25 GMT",
              "sb_gateway_mode": null,
              "sb_gateway_version": "1",
              "transfer_encoding": "chunked",
              "x_kong_proxy_latency": null,
              "x_kong_upstream_latency": null,
              "x_sb_error_code": null
            }
          ],
          "origin_time": 66,
          "status_code": 403
        }
      ]
    }
  ],
  "timestamp": 1745740105122000
}

[iambnlvn]

I am kinda lost in this one, try relaxing the policy with something like

ALTER POLICY "Users can update their own ideas"
ON public.ideas
FOR UPDATE
WITH CHECK (auth.uid() = user_uid);

[GlimmaryKarlR]

@YutaOkoshi , does the thumbs up mean it worked? Im having the same problem. Along with a few other unlucky people on SO.

https://stackoverflow.com/questions/79602538/supabase-rls-issue-code-42501-new-row-violates-row-level-security-policy

[YutaOkoshi]

@Vaullti-KR

No it did not work. Sounds like we have similar problems.

[GlimmaryKarlR]

@YutaOkoshi
i found a resolution ...might work for you too..

https://discord.com/channels/839993398554656828/1369850239346802699

if the link doesn't work try searching in the supbase discord - 42501 permission denied, filter by date - posted yesterday.

[Hallidayo]

Hi all, I'm going to move this over as a discussion due to inactivity. Thanks for your help on this one!