How to Fix Row Level Security (RLS) Bypass in FastAPI
Learn how to prevent and fix Row Level Security (RLS) Bypass vulnerabilities in FastAPI applications. Step-by-step guide with code examples, security checklists, and best practices.
What Is Row Level Security (RLS) Bypass?
Row Level Security (RLS) Bypass is a vulnerability specific to applications using database-level access control policies, most commonly with PostgreSQL (used by Supabase). RLS policies define which rows a given user can read, insert, update, or delete. A bypass occurs when these policies are missing, misconfigured, or can be circumvented, allowing users to access data they should not see.
Common RLS bypass scenarios include: tables with RLS not enabled (all data is accessible by default in Supabase when accessed through the API); overly permissive policies (e.g., allowing all authenticated users to read all rows); policies that only check SELECT but not UPDATE or DELETE; using service_role keys in client-side code (bypasses all RLS); policies that reference `auth.uid()` but do not account for all access paths; missing policies on junction tables in many-to-many relationships; and policies that can be bypassed through PostgreSQL functions that run with `SECURITY DEFINER`.
In Supabase applications, RLS bypass is particularly critical because the database is directly accessible from the client through the Supabase JavaScript SDK. Unlike traditional server-client architectures where the server mediates all data access, Supabase's client SDK makes direct PostgREST calls. This means RLS is often the only access control mechanism between the user and the data.
Why It Matters
In applications using Supabase or similar database-direct architectures, RLS is the primary security boundary. If RLS is bypassed, attackers can read all data from any table (including other users' data, admin data, and sensitive information), modify or delete records belonging to other users, escalate privileges by modifying their own user record, and access data across tenant boundaries in multi-tenant SaaS applications. Because Supabase exposes the PostgREST API directly and the `anon` key is inherently public (embedded in client code), any table without proper RLS policies is completely exposed. This has been a leading source of data breaches in Supabase applications.
How to Fix It in FastAPI
Enable RLS on every table that contains user data. Create explicit policies for each operation (SELECT, INSERT, UPDATE, DELETE) -- do not rely on a single permissive policy. Use `auth.uid()` in policies to filter rows by the authenticated user. Test policies by querying as different users. Never use the `service_role` key in client-side code. Create separate policies for different user roles (admin, user, public). Apply policies to junction tables and related tables, not just primary tables. Use `SECURITY INVOKER` (default) for functions unless you specifically need elevated privileges. Audit all tables regularly with `SELECT tablename, rowsecurity FROM pg_tables WHERE schemaname = 'public'`. Test RLS policies as part of your CI/CD pipeline. Consider using Supabase's built-in RLS testing tools.
FastAPI-Specific Advice
- Use Pydantic models for all request validation. FastAPI automatically validates requests against Pydantic schemas, but ensure all fields are properly typed.
- Use SQLAlchemy ORM or parameterized queries with your database driver. Never use f-strings or string formatting in SQL queries.
- Implement OAuth2 with JWT using FastAPI's built-in `OAuth2PasswordBearer` and proper token validation with `python-jose`.
- Configure CORS middleware explicitly. Use `CORSMiddleware` with specific `allow_origins` rather than wildcards in production.
FastAPI Security Checklist for Row Level Security (RLS) Bypass
FastAPI Security Best Practices
Use Pydantic models for all request validation. FastAPI automatically validates requests against Pydantic schemas, but ensure all fields are properly typed.
Use SQLAlchemy ORM or parameterized queries with your database driver. Never use f-strings or string formatting in SQL queries.
Implement OAuth2 with JWT using FastAPI's built-in `OAuth2PasswordBearer` and proper token validation with `python-jose`.
Configure CORS middleware explicitly. Use `CORSMiddleware` with specific `allow_origins` rather than wildcards in production.
Use `python-dotenv` for environment variables and never hardcode secrets. Keep `.env` files out of version control.
Implement rate limiting using `slowapi` or a reverse proxy. FastAPI does not include built-in rate limiting.
Use `UploadFile` type for file uploads with validation of content type and file size. Process files securely.
Avoid using `pickle.loads()` or `yaml.load()` on untrusted data. Use `json.loads()` for deserialization of user input.
Scan Your FastAPI App with SafeVibe
Stop guessing if your FastAPI app is vulnerable to Row Level Security (RLS) Bypass. Run an automated penetration test in minutes and get actionable results.
Start Free Scan