Storage: Handling File Uploads Properly
Supabase Storage handles file uploads (images, documents, videos) with the same access-control model as your database — buckets and objects, secured by policies rather than an entirely separate system.
A bucket is a named container for files — public or private. A public bucket's files are accessible via a direct URL to anyone; a private bucket requires an authenticated request (or a signed URL) to access. Choose based on what the content actually is — user avatars might reasonably be public; private documents should not be.
Upload via the client library: supabase.storage.from('bucket-name').upload(path, file). Handles the actual file transfer, returning the stored path on success — genuinely straightforward from an application's perspective, without you managing a separate file server.
Storage access is controlled by policies, the same conceptual model as Row Level Security (its own full course later in this track). A bucket's policies define who can upload, download, update, or delete — commonly checking auth.uid() to ensure a user can only manage their own files, the exact same pattern used for database row access.
Signed URLs grant temporary access to a private file without making the bucket public. createSignedUrl(path, expiresIn) generates a time-limited URL — useful for sharing a private document temporarily, or generating a download link that expires, without permanently exposing the file.
Image transformations happen on the fly, without separate processing infrastructure. Supabase Storage can resize and optimize images via URL parameters at request time — useful for serving appropriately-sized images without a separate image-processing pipeline for common cases.
Why this matters for you
File storage security deserves the same deliberate thought as database access — a public bucket holding content that should be private is a genuinely common, easily avoidable mistake this lesson's model directly prevents if applied correctly.
▶️ Before the next lesson
Create one Storage bucket in your Supabase project — decide deliberately whether it should be public or private based on what you'd actually store in it.