File uploads are common in modern applications.
Users may upload:
- Profile photos
- Documents
- Invoices
- Product images
- Private files
The important question is:
Who can access those files?
Storage Buckets
Supabase Storage organizes files into buckets.
You might have:
avatars
documents
product-images
Different buckets can have different requirements.
Public vs Private
Public files may be appropriate for:
Product images
Blog images
Public assets
Private buckets are more suitable for:
Invoices
Personal documents
Private attachments
Storage Policies
Policies can control operations such as:
Upload
Read
Update
Delete
For example, a user might be allowed to upload files only into their own directory.
Organize Files
A structure such as:
user-id/
avatar.png
document.pdf
can make ownership easier to manage.
Avoid Trusting File Paths
Do not assume that a path supplied by the client automatically belongs to the current user.
Validate ownership through your security rules.
Final Thoughts
Storage security should be designed at the same time as database security.
A correctly protected database does not help if private files are publicly accessible.