SupabaseS
Supabase•2y ago
WreckNoFear

Service role not bypassing RLS

I'm creating a SupabaseServerClient using the @supabase/ssr package, it looks like this:

export default async function createSupabaseServerClient() {
  const cookieStore = cookies();
  return createServerClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    process.env.SUPABASE_SERVICE_ROLE_KEY!,
    {
      cookies: {
        get(name: string) {
          return cookieStore.get(name)?.value;
        },

        set(name: string, value: string, options: CookieOptions) {
          cookieStore.set({ name, value, ...options });
        },

        remove(name: string, options: CookieOptions) {
          cookieStore.set({ name, value: "", ...options });
        },
      },
    }
  );
}


This client is used in my Auth callback route to fetch user data, determining if the user is new or not.

If I disable RLS on the users table, it returns the expected result.
If I enable RLS on the users table, it returns a blank result.
The users table has no RLS policies.

Why is this?

I might be misunderstanding something, but I thought the Service Key is meant to bypass RLS. Thanks.
Was this page helpful?