Description
Ensure a sensible global file size limit is set in the Storage settings, and that each bucket restricts the maximum file size and the allowed MIME types to only what the application needs, for example image/png and image/jpeg for an avatars bucket.
Rationale
Without upload limits, users can upload very large files that increase storage costs, or file types such as HTML or scripts that could be used to host malware or phishing pages from your domain. Limiting file size and allowed file types reduces abuse and makes sure buckets only contain the kind of files they were designed for.
Impact
Blocks oversized uploads
Blocks unexpected or dangerous file types
Uploads that break the limits are rejected
Default Value
By default, buckets have no per-bucket file size limit and accept all MIME types. The global file size limit defaults to the plan maximum.
Pre-Requisites
Project Owner, Admin, or Developer role
The allowed file types and sizes for each bucket
Test Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Storage in the sidebar and select Settings, and check the Global file size limit.
For each bucket, open its menu, select Edit bucket, and check Restrict file size and Allowed MIME types.
If limits are missing or too broad, follow the implementation steps.
Implementation Steps
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Storage in the sidebar and select Settings, set a suitable Global file size limit, and save.
For each bucket, open its menu and select Edit bucket.
Enable Restrict file size and enter the maximum size.
Enable the allowed MIME types restriction, enter the types (for example, image/png, image/jpeg), and save.
Backout Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Storage in the sidebar, open the bucket's menu, and select Edit bucket.
Remove the file size and MIME type restrictions and save.
Reference