mirror of
https://github.com/supabase/supabase.git
synced 2026-10-11 12:25:05 +03:00
ferhat elmasandChris Chinchilla
777871aa68
## What kind of change does this PR introduce? Docs ## What is the new behavior? Documents new Storage operation RLS helpers. ## Additional context Related to https://github.com/supabase/storage/pull/903 Signed-off-by: ferhat elmas <elmas.ferhat@gmail.com> Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
106 lines
3.9 KiB
Plaintext
106 lines
3.9 KiB
Plaintext
---
|
|
id: 'storage-access-control'
|
|
title: 'Storage Access Control'
|
|
description: 'Learn how to restrict Supabase file uploads.'
|
|
sidebar_label: 'Uploads'
|
|
tocVideo: '4ERX__Y908k'
|
|
---
|
|
|
|
Supabase Storage is designed to work perfectly with Postgres [Row Level Security](/docs/guides/database/postgres/row-level-security) (RLS).
|
|
|
|
You can use RLS to create [Security Access Policies](https://www.postgresql.org/docs/current/sql-createpolicy.html) that are incredibly powerful and flexible, allowing you to restrict access based on your business needs.
|
|
|
|
## Access policies
|
|
|
|
By default Storage does not allow any uploads to buckets without RLS policies. You selectively allow certain operations by creating RLS policies on the `storage.objects` table.
|
|
|
|
You can find the documentation for the storage schema [here](/docs/guides/storage/schema/design) , and to simplify the process of crafting your policies, you can utilize these [helper functions](/docs/guides/storage/schema/helper-functions) .
|
|
|
|
If you need different `SELECT` policies for different Storage actions, such as listing objects versus reading authenticated objects, use the operation-aware helpers `storage.allow_only_operation()` and `storage.allow_any_operation()` documented in [Storage Helper Functions](/docs/guides/storage/schema/helper-functions).
|
|
|
|
<Admonition type="note">
|
|
|
|
The RLS policies required for different operations are documented [here](/docs/reference/javascript/storage-createbucket)
|
|
|
|
</Admonition>
|
|
|
|
For example, the only RLS policy required for [uploading](/docs/reference/javascript/storage-from-upload) objects is to grant the `INSERT` permission to the `storage.objects` table.
|
|
|
|
To allow overwriting files using the `upsert` functionality you will need to additionally grant `SELECT` and `UPDATE` permissions.
|
|
|
|
## Policy examples
|
|
|
|
An easy way to get started would be to create RLS policies for `SELECT`, `INSERT`, `UPDATE`, `DELETE` operations and restrict the policies to meet your security requirements. For example, one can start with the following `INSERT` policy:
|
|
|
|
```sql
|
|
create policy "policy_name"
|
|
ON storage.objects
|
|
for insert with check (
|
|
true
|
|
);
|
|
```
|
|
|
|
and modify it to only allow authenticated users to upload assets to a specific bucket by changing it to:
|
|
|
|
```sql
|
|
create policy "policy_name"
|
|
on storage.objects for insert to authenticated with check (
|
|
-- restrict bucket
|
|
bucket_id = 'my_bucket_id'
|
|
);
|
|
```
|
|
|
|
This example demonstrates how you would allow authenticated users to upload files to a folder called `private` inside `my_bucket_id`:
|
|
|
|
```sql
|
|
create policy "Allow authenticated uploads"
|
|
on storage.objects
|
|
for insert
|
|
to authenticated
|
|
with check (
|
|
bucket_id = 'my_bucket_id' and
|
|
(storage.foldername(name))[1] = 'private'
|
|
);
|
|
```
|
|
|
|
This example demonstrates how you would allow authenticated users to upload files to a folder called with their `users.id` inside `my_bucket_id`:
|
|
|
|
```sql
|
|
create policy "Allow authenticated uploads"
|
|
on storage.objects
|
|
for insert
|
|
to authenticated
|
|
with check (
|
|
bucket_id = 'my_bucket_id' and
|
|
(storage.foldername(name))[1] = (select auth.jwt()->>'sub')
|
|
);
|
|
```
|
|
|
|
Allow a user to access a file that was previously uploaded by the same user:
|
|
|
|
```sql
|
|
create policy "Individual user Access"
|
|
on storage.objects for select
|
|
to authenticated
|
|
using ( (select auth.jwt()->>'sub') = owner_id );
|
|
```
|
|
|
|
---
|
|
|
|
{/* Finish with a video. This also appears in the Sidebar via the "tocVideo" metadata */}
|
|
|
|
<div className="video-container">
|
|
<iframe
|
|
src="https://www.youtube-nocookie.com/embed/4ERX__Y908k"
|
|
frameBorder="1"
|
|
allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
|
|
allowFullScreen
|
|
></iframe>
|
|
</div>
|
|
|
|
## Bypassing access controls
|
|
|
|
If you exclusively use Storage from trusted clients, such as your own servers, and need to bypass the RLS policies, you can use the `service key` in the `Authorization` header. Service keys entirely bypass RLS policies, granting you unrestricted access to all Storage APIs.
|
|
|
|
Remember you should not share the service key publicly.
|