supabase-postgres-best-practices/skills/supabase/references/realtime-setup-auth.md

title, impact, impactDescription, tags

title	impact	impactDescription	tags
Configure Private Channels with Authentication	CRITICAL	Prevents unauthorized access to real-time messages	realtime, auth, private, rls, security, setAuth

Configure Private Channels with Authentication

Always use private channels in production. Public channels allow any client to subscribe.

Enable Private Channels

Incorrect:

// Public channel - anyone can subscribe
const channel = supabase.channel('room:123:messages')

Correct:

// Private channel requires authentication
const channel = supabase.channel('room:123:messages', {
  config: { private: true },
})

RLS Policies on realtime.messages

Private channels require RLS policies on the realtime.messages table.

Read access (subscribe to channel):

create policy "authenticated_users_can_receive"
on realtime.messages for select
to authenticated
using (true);

Write access (send to channel):

create policy "authenticated_users_can_send"
on realtime.messages for insert
to authenticated
with check (true);

Topic-specific access:

-- Only room members can receive messages
create policy "room_members_can_read"
on realtime.messages for select
to authenticated
using (
  extension in ('broadcast', 'presence')
  and exists (
    select 1 from room_members
    where user_id = (select auth.uid())
    and room_id = split_part(realtime.topic(), ':', 2)::uuid
  )
);

Index RLS Policy Columns

Missing indexes slow channel joins significantly.

create index idx_room_members_user_room
on room_members(user_id, room_id);

Related

• setup-channels.md
• broadcast-database.md
• Docs