1---
2title: Enable Row Level Security for Multi-Tenant Data
3impact: CRITICAL
4impactDescription: Database-enforced tenant isolation, prevent data leaks
5tags: rls, row-level-security, multi-tenant, security
6---
7 
8## Enable Row Level Security for Multi-Tenant Data
9 
10Row Level Security (RLS) enforces data access at the database level, ensuring users only see their own data.
11 
12**Incorrect (application-level filtering only):**
13 
14```sql
15-- Relying only on application to filter
16select * from orders where user_id = $current_user_id;
17 
18-- Bug or bypass means all data is exposed!
19select * from orders;  -- Returns ALL orders
20```
21 
22**Correct (database-enforced RLS):**
23 
24```sql
25-- Enable RLS on the table
26alter table orders enable row level security;
27 
28-- Create policy for users to see only their orders
29create policy orders_user_policy on orders
30  for all
31  using (user_id = current_setting('app.current_user_id')::bigint);
32 
33-- Force RLS even for table owners
34alter table orders force row level security;
35 
36-- Set user context and query
37set app.current_user_id = '123';
38select * from orders;  -- Only returns orders for user 123
39```
40 
41Policy for authenticated role:
42 
43```sql
44create policy orders_user_policy on orders
45  for all
46  to authenticated
47  using (user_id = auth.uid());
48```
49 
50Reference: [Row Level Security](https://supabase.com/docs/guides/database/postgres/row-level-security)
51