How to Fix Row Level Security (RLS) Bypass in Express
Learn how to prevent and fix Row Level Security (RLS) Bypass vulnerabilities in Express applications. Step-by-step guide with code examples, security checklists, and best practices.
What Is Row Level Security (RLS) Bypass?
Row Level Security (RLS) Bypass is a vulnerability specific to applications using database-level access control policies, most commonly with PostgreSQL (used by Supabase). RLS policies define which rows a given user can read, insert, update, or delete. A bypass occurs when these policies are missing, misconfigured, or can be circumvented, allowing users to access data they should not see.
Common RLS bypass scenarios include: tables with RLS not enabled (all data is accessible by default in Supabase when accessed through the API); overly permissive policies (e.g., allowing all authenticated users to read all rows); policies that only check SELECT but not UPDATE or DELETE; using service_role keys in client-side code (bypasses all RLS); policies that reference `auth.uid()` but do not account for all access paths; missing policies on junction tables in many-to-many relationships; and policies that can be bypassed through PostgreSQL functions that run with `SECURITY DEFINER`.
In Supabase applications, RLS bypass is particularly critical because the database is directly accessible from the client through the Supabase JavaScript SDK. Unlike traditional server-client architectures where the server mediates all data access, Supabase's client SDK makes direct PostgREST calls. This means RLS is often the only access control mechanism between the user and the data.
Why It Matters
In applications using Supabase or similar database-direct architectures, RLS is the primary security boundary. If RLS is bypassed, attackers can read all data from any table (including other users' data, admin data, and sensitive information), modify or delete records belonging to other users, escalate privileges by modifying their own user record, and access data across tenant boundaries in multi-tenant SaaS applications. Because Supabase exposes the PostgREST API directly and the `anon` key is inherently public (embedded in client code), any table without proper RLS policies is completely exposed. This has been a leading source of data breaches in Supabase applications.
How to Fix It in Express
Enable RLS on every table that contains user data. Create explicit policies for each operation (SELECT, INSERT, UPDATE, DELETE) -- do not rely on a single permissive policy. Use `auth.uid()` in policies to filter rows by the authenticated user. Test policies by querying as different users. Never use the `service_role` key in client-side code. Create separate policies for different user roles (admin, user, public). Apply policies to junction tables and related tables, not just primary tables. Use `SECURITY INVOKER` (default) for functions unless you specifically need elevated privileges. Audit all tables regularly with `SELECT tablename, rowsecurity FROM pg_tables WHERE schemaname = 'public'`. Test RLS policies as part of your CI/CD pipeline. Consider using Supabase's built-in RLS testing tools.
Express-Specific Advice
- Use `helmet` middleware for setting security headers (CSP, HSTS, X-Frame-Options, etc.) with sensible defaults.
- Use `express-rate-limit` for rate limiting. Apply stricter limits to authentication endpoints and API routes.
- Always use parameterized queries with your database driver. Never concatenate user input into SQL strings.
- Validate request bodies using `express-validator`, Zod, or Joi middleware. Reject requests that do not match expected schemas.
Code Examples
// DANGEROUS -- no authorization check
app.get("/api/projects/:id", async (req, res) => {
const { data } = await supabase
.from("projects")
.select("*")
.eq("id", req.params.id)
.single();
// Any user can access any project!
res.json(data);
});app.get("/api/projects/:id", async (req, res) => {
// Create a client scoped to the user's JWT
const supabase = createClient(
process.env.SUPABASE_URL!,
process.env.SUPABASE_ANON_KEY!,
{
global: {
headers: {
Authorization: `Bearer ${req.user.accessToken}`,
},
},
}
);
// RLS policy enforces user_id = auth.uid()
const { data, error } = await supabase
.from("projects")
.select("*")
.eq("id", req.params.id)
.single();
if (error || !data) {
return res.status(404).json({ error: "Not found" });
}
res.json(data);
});Express Security Checklist for Row Level Security (RLS) Bypass
Express Security Best Practices
Use `helmet` middleware for setting security headers (CSP, HSTS, X-Frame-Options, etc.) with sensible defaults.
Use `express-rate-limit` for rate limiting. Apply stricter limits to authentication endpoints and API routes.
Always use parameterized queries with your database driver. Never concatenate user input into SQL strings.
Validate request bodies using `express-validator`, Zod, or Joi middleware. Reject requests that do not match expected schemas.
Use `cors` middleware with explicit origin allowlists. Never use `cors({ origin: '*' })` in production.
Disable the `X-Powered-By` header with `app.disable('x-powered-by')` or by using helmet.
Use `multer` or `busboy` for file uploads with strict file type and size limits. Store files outside the web root.
Implement proper error handling middleware that does not leak stack traces or internal details in production.
Scan Your Express App with SafeVibe
Stop guessing if your Express app is vulnerable to Row Level Security (RLS) Bypass. Run an automated penetration test in minutes and get actionable results.
Start Free Scan