Question

Supabase storage upload works for me, fails for other users with 403

Solved · 161 viewsasked 20 hours ago by dana_ships

Uploading a lesson PDF works on my account. A colleague gets new row violates row-level security policy from storage. Her console:

What I’ve tried

Compared our accounts. Mine was created first, that's the only difference I see.

Comment

2 answers

Marked as helpful by the asker

mira_dev20 hours ago

Your policy probably hardcodes a folder or your uid, or it checks owner = auth.uid() on update but your colleague inserts into a path outside their folder. Use the folder-per-user pattern:

create policy "own folder" on storage.objects for insert to authenticated
  with check (bucket_id = 'lessons' and (storage.foldername(name))[1] = auth.uid()::text);

and upload to ${user.id}/${filename} in the client. Test with a second account, always.

Comment

The path was hardcoded to my own id, ha. Using the uploader's id now and it works for everyone. dana_ships 19 hours ago

jb_supa18 hours ago

Once inserts work, check the other policies too. An insert policy alone lets your colleague upload, but she can't download her own PDF (needs select), replace it (upload with upsert needs update) or delete it. Same folder check on all of them:

create policy "own folder read" on storage.objects for select to authenticated
  using (bucket_id = 'lessons' and (storage.foldername(name))[1] = auth.uid()::text);

If teachers should see each other's lessons, the select policy is where you open that up, not the insert one.

Comment

Right on cue, downloads were failing for her next. Added select, update and delete with the same check. dana_ships 18 hours ago

Keyboard shortcuts

Supabase storage upload works for me, fails for other users with 403

What I’ve tried

2 answers

Your answer

Supabase storage upload works for me, fails for other users with 403

What I’ve tried

2 answers

Related

Your answer