Gestione dell'accesso con le policy
Implementi un controllo granulare degli accessi ai file usando le policy di Supabase Storage, garantendo la sicurezza dei dati.
Gestione dell'accesso con le policy è una lezione Supabase Backend as a Service gratuita su CoddyKit. Questa è la lezione 2 di 4. Puoi leggere la lezione completa qui gratuitamente — poi esercitati direttamente nel browser con un editor di codice integrato e un tutor IA disponibile 24/7. Fa parte del percorso di apprendimento Supabase Backend as a Service, e i tuoi progressi si sincronizzano tra il web e l'app CoddyKit. Il corso Supabase Backend as a Service include 4 lezioni in totale.
Parti di questa lezione non sono ancora state tradotte e vengono mostrate in inglese.
Intro to Storage Policies
Welcome! In this lesson, we'll dive into Supabase Storage Policies. These policies are your key to controlling who can access, upload, or delete files in your buckets.
Think of them as security guards for your cloud files, ensuring only authorized actions happen.
Why Storage Security Matters
Without proper policies, your files could be vulnerable. Anyone could potentially upload malicious content, or sensitive user data might be publicly exposed.
- Prevent unauthorized access: Keep private files secure.
- Control uploads: Ensure only legitimate users can add files.
- Manage deletions: Prevent accidental or malicious file removal.
Policies are essential for building secure applications.
Enabling RLS for Buckets
Just like with database tables, Supabase Storage uses Row-Level Security (RLS) for buckets. Before you can apply any policies, RLS must be enabled for your storage bucket.
You can do this in the Supabase dashboard under 'Storage' by clicking on a bucket and toggling 'Enable RLS', or directly with SQL:
ALTER TABLE storage.buckets
ENABLE ROW LEVEL SECURITY;Understanding Policy Syntax
Storage policies are written using SQL, similar to database RLS. They specify what actions are allowed (SELECT, INSERT, UPDATE, DELETE) and under what conditions.
Key parts of a policy:
- CREATE POLICY: Starts the policy definition.
- ON storage.objects: Specifies the table policies apply to.
- FOR [action]: Defines the operation (SELECT, INSERT, UPDATE, DELETE).
- USING / WITH CHECK: Sets the conditions for the policy.
Policy: Public Read Access
Let's create a policy to allow anyone to read files from a specific bucket, for example, a 'public-images' bucket. This is common for assets like profile pictures or product images.
The auth.role() = 'anon' part means unauthenticated users, and auth.role() = 'authenticated' means logged-in users. We'll allow both here.
CREATE POLICY "Allow public read access"
ON storage.objects FOR SELECT
TO public
USING (bucket_id = 'public-images');Policy: Authenticated User Uploads
Now, let's create a policy that allows only authenticated users to upload files to a 'user-uploads' bucket. Crucially, we want them to only upload into a folder named after their own user ID.
We use auth.uid() to get the current user's ID and path_tokens[1] to check the first part of the file path.
CREATE POLICY "Allow authenticated user upload"
ON storage.objects FOR INSERT
TO authenticated
WITH CHECK (bucket_id = 'user-uploads' AND auth.uid()::text = path_tokens[1]);Policy: Authenticated User Read Their Own
To complement the upload policy, let's ensure authenticated users can *only* read files that they themselves own within the 'user-uploads' bucket.
This policy uses auth.uid() to match the owner of the file (which is stored in the owner column of storage.objects) and also checks the file path.
CREATE POLICY "Allow authenticated user read their own"
ON storage.objects FOR SELECT
TO authenticated
USING (bucket_id = 'user-uploads' AND auth.uid() = owner);The storage.objects Table
Storage policies operate on the hidden storage.objects table. This table stores metadata about every file in your buckets. Understanding its columns is vital for writing effective policies.
- id: Unique identifier for the object.
- bucket_id: The ID of the bucket the object belongs to.
- name: The full path and filename.
- owner: The
auth.uid()of the user who uploaded the file. - path_tokens: An array of strings representing the path segments.
Policy: Admin-Only Delete
Sometimes, only specific users (like administrators) should be able to delete files. Let's create a policy that allows deletion only if the user has a specific role, for example, an 'admin' role.
This requires a custom function to check user roles, or you can simplify by checking a specific `owner` UID if only one admin account exists.
CREATE POLICY "Allow admins to delete"
ON storage.objects FOR DELETE
TO authenticated
USING (bucket_id = 'sensitive-data' AND auth.jwt() ->> 'user_role' = 'admin');Testing Policies Effectively
After creating policies, it's crucial to test them thoroughly. You can do this by:
- Logging in as different users: Test with authenticated users, unauthenticated users, and users with different roles.
- Attempting forbidden actions: Try to upload, read, or delete files that your policies should prevent.
- Using the Supabase client: Make API calls with
supabase-jsor other client libraries and observe the responses (e.g., expecting 403 Forbidden errors).
Always verify your policies work as intended before deploying to production.
Quick Policy Check
You've learned how to create various Storage policies. Which of the following conditions would allow an authenticated user to insert a file into a bucket named 'private-docs' ONLY if the file is placed in a folder matching their user ID?
Recap: Storage Policies
Great job! You've learned how to secure your Supabase Storage with policies. We covered:
- The importance of RLS for storage buckets.
- Creating policies for various actions (read, insert, delete).
- Using
auth.uid()andpath_tokensfor granular control. - Understanding the
storage.objectstable.
Implementing strong storage policies is crucial for the security and integrity of your application's file management.
Impara Supabase Backend as a Service con un tutor IA — gratis
Scrivi ed esegui vero codice nel tuo browser, ricevi aiuto istantaneo da un tutor IA disponibile 24/7, e riprendi da dove hai lasciato sul web o nell'app.
- Corsi
- 11
- Lezioni
- 40
Domande Frequenti
La lezione «Gestione dell'accesso con le policy» è gratuita?
Sì — il testo completo di «Gestione dell'accesso con le policy» è gratuito qui sul web. Per esercitarvi in modo interattivo (un editor di codice integrato e un tutor IA 24/7) e sbloccare il resto del corso Supabase Backend as a Service, passa a CoddyKit PRO. Il corso Supabase Backend as a Service include 4 lezioni in totale.
Cosa imparerò in «Gestione dell'accesso con le policy»?
Implementi un controllo granulare degli accessi ai file usando le policy di Supabase Storage, garantendo la sicurezza dei dati. Eserciti Supabase Backend as a Service con codice pratico che esegui direttamente nel browser, e un tutor IA 24/7 risponde alle tue domande mentre lavori sulla lezione.
Ho bisogno di esperienza per iniziare Supabase Backend as a Service?
Non è richiesta alcuna esperienza precedente. Supabase Backend as a Service su CoddyKit è strutturato per principianti e studenti avanzati, quindi puoi iniziare da qui o dall'inizio e procedere al tuo ritmo. Questa è la lezione 2 di 4.
Quanto tempo richiede la lezione «Gestione dell'accesso con le policy»?
La maggior parte delle lezioni CoddyKit richiede circa 5–10 minuti. Ogni lezione è breve e interattiva, quindi fai progressi costanti e riprendi esattamente da dove hai lasciato su web e app.
Posso scrivere ed eseguire codice in questa lezione Supabase Backend as a Service?
Sì. Ogni lezione Supabase Backend as a Service include un editor di codice integrato, quindi scrivi ed esegui codice reale direttamente nel tuo browser e ricevi feedback istantaneo dall'IA — nessuna configurazione locale necessaria.
Tutte le lezioni di questo corso
- Archiviazione di file nei bucket Supabase
- Gestione dell'accesso con le policy
- Caricamento e recupero di contenuti multimediali
- Trasformazioni delle immagini e URL firmati