supabase: Realtime Row Level security broken for database-wide subscriptions on PG12
Bug report
Describe the bug
Affects
- PG12
- PG14 (although these will only be new use-cases, so nobody should be experiencing the bug)
Unaffected
- PG13 users. If you are experiencing problems with PG13, it is probably because your Policies are not allowing access (whereas previously Policies weren’t applied). This is intended behaviour - your database security is working properly
Description
We’re discovered an issue as a result of our Row-Level Security Realtime updates for that affects any database-wide publications. (eg CREATE PUBLICATION supabase_realtime FOR ALL TABLES;
)
To Reproduce
Realtime subscription may have stopped you are on PG12 and you have a Publication in your database set up like

Workaround
Disable the FULL
publication (red) and enable each table individually (green)
About this issue
- Original URL
- State: closed
- Created 3 years ago
- Reactions: 1
- Comments: 44 (25 by maintainers)
UPDATE
We’re currently rolling out the fixes to all projects, and some projects may have already been fixed depending on your project’s region.
UPDATE
We have rolled out the fixes to all projects. If you’re still experiencing Realtime issues then please drop a comment here and/or email support@supabase.io with your project ref and we’ll investigate. Thanks!
@batuhanbilginn @GaryAustin1 I just merged in a fix that addresses certain types for primary keys not working as well as filtering not working for types like
int
. We’ll be rolling out the changes to all projects as soon as possible.Thanks for reporting these issues!
@kk21 there’s currently an issue with listening to tables with
uuid
as primary key. we’re in the process of putting in a fix and will report back here once it’s deployed.@GaryAustin1 I’ve got it working by turning off and on again the replication for the project.
Thanks for the fix @w3b6x9 🙌
I sent an email. It is always after a 2nd client signs in the other client will drop realtime on it’s next token refresh. AND the websocket is showing constant loop trying to JOIN again. My subscribes though are not rerunning (console.log right before setups not firing) so I suspect realtime.js is doing the looping joins…
We will support this @kachar - a fix should be available early this week
It looks like a permission issue is blocking
pg_dump
on our side:Granting privileges to the table using the online SQL editor solved the issue:
@w3b6x9 Are you guys planning to support the
anon
role as well as theauthenticated
role as both of these are valid regarding the usage of RLS?In our apps, we’ve got policies for both anonymous and logged-in users and currently, the real-time updates work only for authenticated.
If this feature is out of the roadmap, we’ll need to make changes to our app flow, so it’s good to know in advance. 🙇♂️
@michaelketzer ah, apologies for making the assumption that you were using it client-side! If you send an email to support@supabase.io with a link to your comment then I can follow up and inform you when
service_role
role is available in Realtime RLS. We’re sorry it isn’t working for your use case today!@w3b6x9
That does make sense, thank you for the detailed explanation!
I didn’t mention that i am using it for server side implementations only 😬 There is nothing exposed to the client and I want to bypass the RLS there as my apps are working with all rows.
I guess, I will switch to polling for now.
Thank you again 🙏
@michaelketzer I think you’re experiencing a different issue.
Realtime RLS currently only works with the
authenticated
role (in the case that RLS is enabled for a table), and we’re working hard to make it compatible with other roles likeservice_role
.Also, we do not recommend using the
service_role
key when creating clients withsupabase-js
.service_role
role is designed to bypass RLS, which is a security concern if exposed on the client. Please refer to Never use a service key on the client for best practices.You can use your
anon
key to connect to the client viasupabase-js
, and if you and/or your users are signed in, then Realtime RLS tracks the authenticated users after they’ve subscribed to topics and determines whether or not they should receive changes to a database table based on your RLS policies.Hi! I’m facing this issue on PG13, i’ve policies on
comments
table forselect
usingauth.role()='authenticated'
and for insert with checkauth.role()='authenticated'
too.I’ve already enable realtime for
comments
tablealter publication supabase_realtime add table comments;
When I’m trying to subscribe realtime with this code:
the new comment does not appear on the
console.log
I’ve also run this before with no luck:
I’ve another table with RLS disabled and has realtime active and the realtime do the job correctly.
@clouedoc Thanks for reporting and sharing your workaround! Can you please email support@supabase.io with your project ref so we may investigate?
Yeah, now I’m sure it’s related to RLS. When I subscribe to the table directly it works however if I subscribe to a specific row by using a filter it doesn’t work anymore. Also, RLS disabled on those tables. I think there is some kind of bug in my project 😦