Storage bucket policies so users only reach their own files

Open · 3 views · asked 3 weeks ago by olu_backend · edited

Storage has its own policies; enabling RLS on your tables does nothing for uploaded files. This assumes the path avatars/<user id>/<file>, which the client has to write. Check the bucket is private before you test.

Snippet

Copied 5 times

insert into storage.buckets (id, name, public)
values ('avatars', 'avatars', false)
on conflict (id) do nothing;

create policy "read own files" on storage.objects for select to authenticated
  using (bucket_id = 'avatars' and (storage.foldername(name))[1] = auth.uid()::text);

create policy "upload own files" on storage.objects for insert to authenticated
  with check (bucket_id = 'avatars' and (storage.foldername(name))[1] = auth.uid()::text);

create policy "delete own files" on storage.objects for delete to authenticated
  using (bucket_id = 'avatars' and (storage.foldername(name))[1] = auth.uid()::text);

Comment

Keyboard shortcuts

Storage bucket policies so users only reach their own files

Snippet

Activity