Description

Ensure Realtime is configured so that data is only sent to users who are allowed to see it. Public channel access should be disabled so clients must use private channels controlled by RLS policies on realtime.messages, and every table streamed through Postgres Changes should have RLS enabled.

Rationale

Realtime can push database changes and messages to connected clients as they happen. If public channels are allowed, or if tables streamed through Postgres Changes do not have RLS, any client may receive messages or data changes intended for other users. Requiring private channels and RLS makes sure Realtime follows the same access rules as the rest of the API.

Impact

  • Only authorized users receive Realtime messages

  • Prevents data leaks through live updates

  • Clients must use private channels and valid user tokens

Default Value

By default, Realtime allows public channels. Postgres Changes respects RLS only on tables where RLS is enabled.

Pre-Requisites

  • Project Owner or Admin role

  • Application changes to use private channels

Test Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Realtime in the sidebar and select Settings.

  4. Verify that Allow public access is disabled.

  5. Open Database in the sidebar, select Publications, and check which tables are in supabase_realtime.

  6. Verify that each of those tables has RLS enabled.

  7. If public access is allowed or a table lacks RLS, follow the implementation steps.

Implementation Steps

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. In the SQL Editor, create RLS policies on realtime.messages that allow only the right users to join each channel.

  4. Update the application to create channels with the private: true option.

  5. Open Realtime in the sidebar, select Settings, and disable Allow public access.

  6. Enable RLS on every table in the supabase_realtime publication.

Backout Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Realtime in the sidebar and select Settings.

  4. Enable Allow public access and save.

Reference