Cannot bypass RLS using `service_key`

[biowaffeln]

Bug report

• [x] I confirm this is a bug with Supabase, not with my own application.
• [x] I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

I'm using the auth-helpers-nextjs package with Next.js 13. I want to create an route handler that bypasses RLS using my service key, however when I instantiate a client and try to insert something into a table with RLS, I get the error "new row violates row-level security policy for table ...".

To Reproduce

1. create a table, enable RLS without any policies
2. create a route handler and init a client, like this:

  const supabase = createRouteHandlerClient(
    { cookies },
    { supabaseKey: process.env.SUPABASE_SERVICE_KEY }
  );

3. try to insert data into the table

   await supabase.from("table_name").insert(data);

4. get an error "new row violates row-level security policy for table 'table_name'"

For comparison, when I try to create a client directly with the @supabase/supabase-js package, the insert works:

  const service = createClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL,
    process.env.SUPABASE_SERVICE_KEY
  );

  await service.from("table_name").insert(data); // works without a problem

System information

• @supabase/auth-helpers-nextjs: 0.7.2
• @supabase/supabase-js: 2.26.0
• node: 20.2.0

[silentworks]

You cannot use service role with the auth-helpers, this would be a security issue. The auth-helpers by default doesn't allow you to use the service_role secret as this could lead to you leaking your service_role secret to the public. auth-helpers work in both the server and client side so there is no clear way to separate the key when using it in the client environment. You can however create a separate Supabase client using the @supabase/supabase-js createClient method and pass it the service_role``secret. You will also need to turn some properties off since you are working in a server environment.

import { createClient } from '@supabase/supabase-js';

const supabase = createClient(supabaseUrl, serviceRoleSecret, {
    auth: {
        persistSession: false,
        autoRefreshToken: false,
        detectSessionInUrl: false
    }
});

[anuoua]

You cannot use service role with the auth-helpers, this would be a security issue. The auth-helpers by default doesn't allow you to use the service_role secret as this could lead to you leaking your service_role secret to the public. auth-helpers work in both the server and client side so there is no clear way to separate the key when using it in the client environment. You can however create a separate Supabase client using the @supabase/supabase-js createClient method and pass it the service_rolesecret ``. You will also need to turn some properties off since you are working in a server environment.

import { createClient } from '@supabase/supabase-js';

const supabase = createClient(supabaseUrl, serviceRoleSecret, {
  auth: {
      persistSession: false,
      autoRefreshToken: false,
      detectSessionInUrl: false
  }
});

The auth params is much important! the doc creating-a-client need update.

[silentworks]

Hi @anuoua, why do you think that needs updating please? my example above is how to use the service_role key with supabase-js, not the auth-helpers.