How to Fix Row Level Security (RLS) Bypass in Ruby on Rails
Learn how to prevent and fix Row Level Security (RLS) Bypass vulnerabilities in Ruby on Rails applications. Step-by-step guide with code examples, security checklists, and best practices.
What Is Row Level Security (RLS) Bypass?
Row Level Security (RLS) Bypass is a vulnerability specific to applications using database-level access control policies, most commonly with PostgreSQL (used by Supabase). RLS policies define which rows a given user can read, insert, update, or delete. A bypass occurs when these policies are missing, misconfigured, or can be circumvented, allowing users to access data they should not see.
Common RLS bypass scenarios include: tables with RLS not enabled (all data is accessible by default in Supabase when accessed through the API); overly permissive policies (e.g., allowing all authenticated users to read all rows); policies that only check SELECT but not UPDATE or DELETE; using service_role keys in client-side code (bypasses all RLS); policies that reference `auth.uid()` but do not account for all access paths; missing policies on junction tables in many-to-many relationships; and policies that can be bypassed through PostgreSQL functions that run with `SECURITY DEFINER`.
In Supabase applications, RLS bypass is particularly critical because the database is directly accessible from the client through the Supabase JavaScript SDK. Unlike traditional server-client architectures where the server mediates all data access, Supabase's client SDK makes direct PostgREST calls. This means RLS is often the only access control mechanism between the user and the data.
Why It Matters
In applications using Supabase or similar database-direct architectures, RLS is the primary security boundary. If RLS is bypassed, attackers can read all data from any table (including other users' data, admin data, and sensitive information), modify or delete records belonging to other users, escalate privileges by modifying their own user record, and access data across tenant boundaries in multi-tenant SaaS applications. Because Supabase exposes the PostgREST API directly and the `anon` key is inherently public (embedded in client code), any table without proper RLS policies is completely exposed. This has been a leading source of data breaches in Supabase applications.
How to Fix It in Ruby on Rails
Enable RLS on every table that contains user data. Create explicit policies for each operation (SELECT, INSERT, UPDATE, DELETE) -- do not rely on a single permissive policy. Use `auth.uid()` in policies to filter rows by the authenticated user. Test policies by querying as different users. Never use the `service_role` key in client-side code. Create separate policies for different user roles (admin, user, public). Apply policies to junction tables and related tables, not just primary tables. Use `SECURITY INVOKER` (default) for functions unless you specifically need elevated privileges. Audit all tables regularly with `SELECT tablename, rowsecurity FROM pg_tables WHERE schemaname = 'public'`. Test RLS policies as part of your CI/CD pipeline. Consider using Supabase's built-in RLS testing tools.
Ruby on Rails-Specific Advice
- Rails auto-escapes HTML in ERB templates by default. Never use `raw()` or `html_safe` with unsanitized user content.
- Use ActiveRecord query interface with parameterized conditions. Never use string interpolation in `where()` clauses.
- Keep Rails' built-in CSRF protection enabled. Use `protect_from_forgery with: :exception` in ApplicationController.
- Use Strong Parameters (`params.require(:model).permit(:field)`) to prevent mass assignment vulnerabilities.
Ruby on Rails Security Checklist for Row Level Security (RLS) Bypass
Ruby on Rails Security Best Practices
Rails auto-escapes HTML in ERB templates by default. Never use `raw()` or `html_safe` with unsanitized user content.
Use ActiveRecord query interface with parameterized conditions. Never use string interpolation in `where()` clauses.
Keep Rails' built-in CSRF protection enabled. Use `protect_from_forgery with: :exception` in ApplicationController.
Use Strong Parameters (`params.require(:model).permit(:field)`) to prevent mass assignment vulnerabilities.
Configure `force_ssl` in production to enforce HTTPS. Set `config.force_ssl = true` in `production.rb`.
Use `has_secure_password` with bcrypt for password handling. Never implement custom password hashing.
Use `rack-attack` gem for rate limiting and throttling. Block suspicious IPs and limit authentication attempts.
Keep `secret_key_base` secret and never commit it to version control. Use Rails credentials or environment variables.
Scan Your Ruby on Rails App with SafeVibe
Stop guessing if your Ruby on Rails app is vulnerable to Row Level Security (RLS) Bypass. Run an automated penetration test in minutes and get actionable results.
Start Free Scan