Database / Supabase Intermediate to Advanced Interview Questions
Why do private Realtime channels need their own RLS-style authorization check?
A Realtime Broadcast or Presence channel isn't backed by a specific table row the way a Postgres Changes event is — there's no underlying SELECT ... WHERE for Postgres's RLS engine to filter, because the "message" being sent might be an arbitrary payload like a cursor position or a chat line that never touches a table at all.
Without a dedicated authorization step, any client holding a valid JWT could subscribe to any channel name and both read and publish messages on it, since a channel name alone (like room-42) carries no inherent permission information the server can check against ordinary table policies. Requiring an explicit authorization check — typically a function that looks up whether the calling user is actually a participant in that room — closes that gap, making channel access something the application deliberately grants per user rather than something implied just by knowing (or guessing) a channel's name.
More Related questions...
