Updated
Storage: Private bucket files are still accessible after you remove access or logout
A user can sometimes still download a file from a private bucket after you remove their access. This happens after you change an RLS policy or sign the user out. It affects files requested through the authenticated endpoint:
https://[project_id].supabase.co/storage/v1/object/authenticated/[bucket]/[asset-name]Cause
A cached response skips the Storage service’s access check. Two caches can do this:
- The browser cache can answer the request without contacting Supabase. See cache eviction.
- The Storage CDN caches a file based on the user and their access at the time of caching. It keeps serving that response until the user’s access token (JWT) expires. This includes after the Auth session ends.
Fix
- If an RLS change removed the user’s access, purge the CDN cache. The next request is checked against your current access rules. The purge can take up to 60 seconds to propagate.
- To shorten how long the CDN honors a signed-out user’s access, lower the access token expiry in your project’s Sessions settings.
A purge doesn’t clear browser caches. For files you might need to revoke, set a shorter cacheControl value when you upload them.
Prevent
Use signed URLs to serve private files. You control access with an expiry time.
Other options:
- Use the S3 API, which doesn’t use caching.
- Route requests through custom code (e.g. Edge Functions), which checks current access rules and sign-in state before it fetches the file.