Impersonation no longer works in Dashboard when using PostgREST's db_pre_request hook to set current_setting
Bug report
- I confirm this is a bug with Supabase, not with my own application.
- I confirm I have searched the Docs, GitHub Discussions, and Discord.
Describe the bug
When using both the Hosted and the Local Dashboards, it seems like the pgrst.db_pre_request hook is no longer working properly when impersonating users via the Dashboard.
However, when initiating the same process properly triggers the pre-request hook in PostgREST, e.g. when I invoke it from the JavaScript SDK etc.
To Reproduce
Steps to reproduce the behavior:
- Implement a
pgrst.db_pre_requesthook function, for example for RLS - Call anything which could trigger it from the Dashboard while Impersonating
- Invoke this function from:
- Supabase JS SDK (works correctly)
- Supabase Dashboard (with user impersonation, fails)
- Notice the logs don't appear when invoking in the Supabase's Dashboard thorugh impersonation, but works when invoking via prod.
Expected behavior
The db_pre_request function should be executed when impersonating users from the Dashboard - this has worked until a few hours ago, or at least until the latest pull of the Docker containers for the local enviroment where I've been working in - this might be correlated but not causing it.
Ensure that impersonation in the Supabase Dashboard invokes the full PostgREST lifecycle, including pgrst.db_pre_request, so session-based logic behaves the same way as client SDK usage.
Alternatively, allow configuration or toggles to opt into such behavior, or expose a way to simulate auth.uid() during dashboard impersonation.
System information
- OS: Any
- Browser: Chrome, Safari, Firefox (all)
- Version of supabase-js: tested with latest
- Version of Node.js: N/A
- Supabase Environment: Hosted and Local both affected
Source: supabase/supabase