Being careful with current_user usage and understanding auth.role()

current_user is a variable in Postgres that identifies the active user role within the current SQL execution context. We haven’t discussed this variable yet, but I want to make you aware of its potential drawbacks. Some developers who have worked with Postgres databases might be familiar with using current_user. However, relying on this variable can lead to issues, and I want to ensure you understand its limitations to avoid potential pitfalls.

Let’s create an example with current_user. When we make a request with PostgREST (by using the normal API/Supabase client) without authentication, the role is anon. This means that, in pure theory, you could make use of this current_user value – for example, within an RPC, as shown here, differentiating the access of admin users versus non-admin users:

CREATE OR REPLACE FUNCTION get_latest_user_data() RETURNS TEXT
SECURITY INVOKER
VOLATILE
LANGUAGE...