# Realtime Postgres RLS now available on Supabase

[Supabase](https://yomu.fyi/company/supabase) · Oliver Rice · Dec 1, 2021

**Type:** Announcement

## Summary

Supabase updated its Realtime server to enforce PostgreSQL Row Level Security (RLS) policies when broadcasting database changes over websockets. Previously, Realtime operated as an opt-in beta feature that sent all replication changes to every client regardless of user authorization. To enforce RLS per subscriber without heavy performance overhead, Supabase introduced WALRUS, a security engine colocated inside PostgreSQL. For each replication change, WALRUS looks up active subscribers, assumes their identities, and evaluates row visibility using prepared statements queried by primary key. This in-database evaluation avoids external network round trips and single-query planning overhead while returning an authorized subscriber list to Realtime.

## Context

Supabase Realtime decodes PostgreSQL logical replication changes and broadcasts them to clients over websockets. Previously, Realtime did not enforce Row Level Security, broadcasting all table modifications to all connected clients. Because each subscriber can have distinct visibility rules, evaluating row access individually for every change and subscriber introduced severe performance bottlenecks.

## Approach / What changed

Supabase implemented Write Ahead Log Realtime Unified Security (WALRUS), an in-database PostgreSQL function invoked by the Realtime server. WALRUS inspects replication changes, queries an internal subscription table to identify active subscribers, and assumes each subscriber's identity to check row visibility. The visibility checks execute prepared statements queried by primary key, reducing PostgreSQL query planning overhead and eliminating network round-trip latency by colocating the security checks directly within the database.

## Takeaways

- Prepared statements bypass PostgreSQL query planner overhead, which frequently accounts for two to three times the execution time of simple primary-key lookups.
- Colocating the WALRUS security engine inside PostgreSQL eliminates network round-trip latency and I/O bottlenecks by processing subscriber authorization in a single connection.
- Realtime RLS processing time scales with the number of subscribers, ranging from 11.2 ms for 1 subscriber to 303.8 ms for 10,000 subscribers per record.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [Authentication](https://yomu.fyi/topic/authentication), [Performance](https://yomu.fyi/topic/performance), [Postgres](https://yomu.fyi/topic/postgres), [Streaming](https://yomu.fyi/topic/streaming)

[Read original post](https://supabase.com/blog/realtime-row-level-security-in-postgresql)