Supabase存储桶创建时的行级安全（Row-level security）问题求助

Hey there! I’ve run into this exact error plenty of times when working with Supabase Storage—usually it boils down to missing or misconfigured row-level security (RLS) policies that block your user from interacting with storage buckets and objects. Let’s fix this step by step:

1. Confirm RLS is enabled (and enable it if not) #

First, make sure RLS is turned on for both storage tables. Run these commands in your Supabase SQL Editor:

ALTER TABLE storage.buckets ENABLE ROW LEVEL SECURITY;
ALTER TABLE storage.objects ENABLE ROW LEVEL SECURITY;

2. Create the required RLS policies #

You need two core policies to let users manage their own buckets and the objects inside them:

Policy for storage.buckets (let users create/access their own buckets) #

-- Allow users to create buckets they own
CREATE POLICY "Users can create their own buckets" ON storage.buckets
  FOR INSERT WITH CHECK (auth.uid() = owner);

-- Allow users to view buckets they own
CREATE POLICY "Users can view their own buckets" ON storage.buckets
  FOR SELECT USING (auth.uid() = owner);

Policy for storage.objects (let users manage objects in their buckets) #

-- Allow users to upload, view, and delete objects in buckets they own
CREATE POLICY "Users can manage objects in their own buckets" ON storage.objects
  FOR ALL USING (
    auth.uid() = (SELECT owner FROM storage.buckets WHERE id = bucket_id)
  );

3. Tweak your bucket creation code (for better alignment) #

When creating the bucket, explicitly set the owner to the current user’s ID. This ensures the bucket is properly linked to the user, which our policies rely on:

const { data, error } = await supabase
  .storage
  .createBucket(`bucket-${user.id}`, { 
    public: false,
    owner: user.id // Add this line to associate the bucket with the user
  });
console.log(data, error);

Why this works #

• The bucket policies ensure only the user who owns a bucket can create or view it.
• The objects policy checks that the current user owns the bucket containing the object, granting them full access to manage those files.

After setting these up, try creating your bucket and uploading files again—this should resolve the RLS violation error.

内容的提问来源于stack exchange，提问作者Gustavo