Realtime + RLS, not working on hosted supabase instance.

[skizer]

Hey folks,

after reading tons of discord messages and old issues on github it seems like there's something wrong with the hosted instance of supabase in correlation with Realtime + RLS.

Access is all granted via policy, socket gets created and connects and the realtime->subscription table gets populated with the subscription.
According to the latest blog post, the hosted version of supabase supports RLS+Realtime, am I wrong?

I've struggled a bit with a fairly simple scenario for a while now until I found the official blog post where they've announced that RLS now also affects the real-time subscription feature.

So with the RLS in effect for subscriptions, is it even possible now to notify subscribers (anon for example) on things like DELETE and UPDATE even tho they only have permission for SELECT?

[GaryAustin1]

Unless it broke in the last couple of days, and I’ve seen no reports of that (assuming you also asked this same thing on discord) , it works with RLS on hosted.

One thing you could check is if it sends a user or anon token in the websocket message.
How are you subscribing to realtime on the client?

[GaryAustin1]

Also double check you are running on a recent client software version. Ran into someone who had supabase-js from last year and it does not support the RLS feature.

[skizer]

Just to be on the safe side, I've cleared all npm caches and setup a fresh vite/vue project with the latest supabase.js client version and tested it again.

[skizer]

Hey gary, thanks for your response!

I do really have no clue why it's not working, I've checked the websocket, it sends the anon token as user_token, the server responses correctly, the subscription get's added to the database with the anon role set.

I can do CRUD operations just fine with the anon token for the desired table in the public schema.
All I know is the moment I activate RLS for that table that realtime doesn't fire anymore.

onMounted(() => {
  sub.value = client
    .from("test")
    .on("*", (payload) => {
      console.log("updated", payload);
    })
    .subscribe();
});

[GaryAustin1]

This is what the websocket should look like for a RLS update (select policy role authenticated) with a signed in user: Note the update message.

This is what socket looks like with no user logged in. Note the access token is null:

Note the difference in having an access token for logged in user versus not above. The access token is filled in with the user jwt in follow up heartbeats. Logged in user:

[skizer]

Wait, does that mean it won't work with only the anon_public token set when init. the supabase.js client?
Like that's literally what they've said, the changes should make it work with the anon role too.

Btw. I've tried it with faking the auth by setting supabase.auth.setAuth to the anon_token, so the access_token gets filled with the anon_token. Still won't fire.

May I ask if this example you've posted is from a fresh project?

P.S #4342

//Update
Just to make sure, it also doesn't work with authenticated users/role

[GaryAustin1]

Anon works fine too with no user, if your select RLS allows it. I think this test instance I'm using is 6 months old, but my year old one worked with RLS last time I checked.

[GaryAustin1]

With no logged in user, RLS on, select policy for anon.

[joshua1996]

Realtime + RLS only working in DELETE event

[w3b6x9]

@joshua1996 is this still the case for you?

[m0nac0]

I have a similar issue with the Flutter SDK. No matter what I try, as soon as I enable RLS (even with the 'Enable read access for all users' template policy enabled) no realtime updates are received anymore. I can still see the authenticated subscription in the realtime.subscription table, though.
And when the app executes a SELECT, it receives all the new rows, so it's not an issue with the RLS policies.

As soon as I disable RLS, realtime starts working again.

[GaryAustin1]

There was an issue on Supabase side, fix being rolled out now. supabase/realtime#265 (comment)

[m0nac0]

Thanks, that's good to hear. I started to think I'm stupid, since my code is functionally equivalent to the official examples and I still didn't get it to work in the last 2 days 😂

[m0nac0]

I can confirm that running the query linked above instantly fixed the issue for me.

[w3b6x9]

@skizer are you still having Realtime issues?

[ankitparmar007]

@w0wka91 I am facing same problem

[LivioGama]

Same for me, using a policy with custom auth provider and jwt

[LivioGama]

This can also be due to this if you have trouble with realtime, upgrade supabase client to 2.24.0 supabase/supabase-js@b55d386

[LivioGama]

That was not it, I decided to write a whole medium post for avoiding you waste time in the future: https://liviogamassia.medium.com/using-supabase-rls-with-firebase-auth-custom-auth-provider-357eaad9c70f

[huyouare]

I was also having an issue with RLS not working as expected when combined with the Realtime API on a Supabase hosted instance. Adding this line fixed the problem for me:

const supabaseAccessToken = await getToken({ template: "supabase" });
const supabase = await supabaseClient(supabaseAccessToken as string);
supabase.realtime.accessToken = supabaseAccessToken; // THIS IS REQUIRED FOR RLS!!!

[simonhackler]

Insane. Thank you so much. Sometimes this token would be set automatically for me and sometimes not. This fixed it.

[ddematheu]

@huyouare just came here to say that you are a gentleman and a scholar, this fixed it for me.