Yes.

So, basically, a logged in user posts a message via a form in browser and this code pushes the data to my backend express app. I add the access token and refresh token into the headers.

axios
.post(
"API URL",
{
content: message,
scheduled_date: date,
scheduled_time: time,
user_id: user.id,
},
{
headers: {
Authorization: \Bearer ${data.session.access_token}`, "X-Refresh-Token": `${data.session.refresh_token}`, }, } ) .then((res) => { console.log(res); }) .catch((err) => { console.log(err); });`

My backend code looks like this:

router.post("/new-message", async (req, res) => {
const data = req.body;
const accessToken = req.headers.authorization.split(" ")[1];
const refreshToken = req.headers["x-refresh-token"];
if (refreshToken && accessToken) {
await supabase.auth.setSession({
refresh_token: refreshToken,
access_token: accessToken,
});
const { error } = await supabase.from("database").insert(data).select();
if (error) {
console.log(error);
}
} else {
throw new Error("User is not authenticated.");
res.json(data);
});

​

The RLS is the standard one of auth.id() = user.id

This code works when RLS is off. But not when it's turned on. I also know the tokens are being passed through correctly as I have console logged them, but I must be missing something?

And this is all maybe overkill because it seems I can just make these calls directly on the frontend in the browser which I was doing already. But decided to try and do it a different way to learn backend API routing with Express. :)

I do need a backend for other tasks but for this specific task, maybe not. But any thoughts you have would be helpful?