Stuck with a 403 error - new row violates row-level security policy for table
I just created a new project with all the tables I need as well as a
user_profiles table with a uuid field that references auth.users.id. When trying to create a new record for another table in the frontend I started to get the 403 error - new row violates row-level security policy for table \"locations\" error. After a lot of debugging I found that when I set the RLS to a fixed true value, it works, and returns the records I added directly on the DB, but with simply adding a user-match by uid (picture 1) in the RLS I go back to an empty list in the returned body and a 403 error when trying to create a record. The JWT sent in the request contains the right data and the right sub that is saved in the DB (picture 2) and the DB relation between tables is also ok (picture 3). I even check the query on the editor and it returned true (picture 4)
Right now I'm out of ideas on how to solve the issue. I tried deleting the column/reference, Double checking the relationships and making sure the datatypes are the same, renaming the table/column, etc. But it seems that no matter what I do when I run that expression in the RLS policy it always returns false
The weird thing is that this same codebase was working fine with another supabase project, but due to some major changes in the DB I decided to delete it and create this one
OS: Windows 11
frameworkd: Next.js 15.3.2
Platform: Web
Library:
"@supabase/ssr": "^0.6.1",
"@supabase/supabase-js": "^2.49.8",
4 Replies
Likely you don't have a user session when you make the call. If you check the Gateway API logs there is an entry for Role and in details the user id will show up IF the role is authenticated. If the role is anon they the client calling the REST API does not have a session in it.
The role is authenticated, and there's an
sb array that has the correct user id (I cut the part where the subject appears but the JWT array also has a subject field that is the same as the auth_user field)
I missed you were not just doing auth.uid() compared to your id column. You are accessing another table. You will need to meet select RLS on that table.
🤦♂️ Gotcha, that was the issue. Thank you very much