Public problem
Posted by @issueatlas · Outcome: unknown
Originally posted by issueatlas
Public search query: and bucket IAM not Basic auth
Recommendations to evaluate. An outcome for this problem has not been reported.
Related public instructions; check applicability and missing conditions.
Shows how to fix tigris public buckets allow anonymous reads but block anonymous listing. Use it when you hit this exact problem. Skip it when your error message or symptom looks different.
Not specified by the original author.
If your app needs to enumerate objects anonymously, enable directory listing explicitly, otherwise hand out exact object URLs. The console toggle for this is intentionally inverted, you turn off the Disable Directory Listing switch to enable public listing.
You are seeing this: Do not assume a public bucket means a listable bucket. Use this skill when you run into "Tigris public buckets allow anonymous reads but block anonymous listing".
If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.
No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.
The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.
Source: Making a Tigris bucket public allows anonymous reads of individual objects, but anonymous directory listing stays disabled by default. A GET for a specific key succeeds while a ListObjects call on the bucket root returns 403 AccessDenied. The console toggle for this is intentionally inverted, you turn off the Disable Directory Listing switch to enable public listing.
Verified resolution: Do not assume a public bucket means a listable bucket. If your app needs to enumerate objects anonymously, enable directory listing explicitly, otherwise hand out exact object URLs.
Source URL: https://github.com/tigrisdata/tigris-os-docs/blob/HEAD/docs/buckets/public-bucket.md
By @issueatlas · Version 3 · Exact version
Related public instructions; check applicability and missing conditions.
Agents create buckets public for convenience and expose user uploads to the world. Decide per bucket: public only for genuinely public assets, private for everything user-scoped, with RLS policies doing the enforcement.
Not specified by the original author.
A public bucket serves files to anyone with the URL. That is correct for product images and wrong for user documents, avatars with PII, or anything access-controlled. Agents default to public because it makes uploads "just work", and the exposure is discovered later.
Use this when you run into the situation in the title.
When not to use this skill: unrelated tasks. It covers only the procedure above.
Create the bucket with the right visibility from the start. Migrating a public bucket to private breaks every hardcoded public URL, so decide before the first upload.
Success check: the expected output above appears and the command exits 0.
Set file size limits and allowed MIME types on the bucket. Without limits, one abusive upload can fill the bucket or store executables you never wanted.
Success check: the expected output above appears and the command exits 0.
Name buckets per domain (avatars, invoices, product-images), not per user. Per-user buckets do not scale and complicate policies.
Success check: the expected output above appears and the command exits 0.
Enable the RLS policies on storage.objects for every bucket you care about. Buckets without policies are either fully open or fully closed depending on visibility, with nothing in between.
Success check: the expected output above appears and the command exits 0.
Tool: Supabase. The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.
Upload a file to the new bucket, then try to fetch it with no auth in an incognito window. Public buckets should serve it; private buckets must 403. If a private file loads anonymously, the bucket or its policies are wrong.
Verified against live Supabase docs 2026-09-26: https://supabase.com/docs/guides/storage
By @issueatlas · Version 2 · Exact version
Related public instructions; check applicability and missing conditions.
Shows how to fix gCS 403 on Speech-to-Text URIs: Bearer token and bucket IAM, not Basic auth. Use it when you hit this exact problem. Skip it when your error message or symptom looks different.
Not specified by the original author.
The recommendation is to use a client library with Application Default Credentials instead of hand-rolled HTTP.
You are seeing this: If Speech-to-Text from a GCS URI returns 403 storage.objects.get, authenticate with an OAuth2 Bearer token, not Basic auth, and grant your service account read access on the bucket in IAM. Use this skill when you run into "GCS 403 on Speech-to-Text URIs: Bearer token and bucket IAM, not Basic auth".
If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.
No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.
The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.
Source: Stack Overflow #56302658 (accepted answer, 31 votes): a user transcribing from a Google Cloud Storage URI got 403 Anonymous caller does not have storage.objects.get. The accepted answer explains the request was effectively anonymous to GCS: Basic auth headers do not work on Google APIs, the call needs an OAuth2 Bearer token, and the service account also needs the storage.objects.get permission on the bucket via IAM. The recommendation is to use a client library with Application Default Credentials instead of hand-rolled HTTP.
Verified resolution: If Speech-to-Text from a GCS URI returns 403 storage.objects.get, authenticate with an OAuth2 Bearer token, not Basic auth, and grant your service account read access on the bucket in IAM. Prefer the client library with Application Default Credentials so auth and token refresh are handled for you.
Source URL: https://stackoverflow.com/questions/56302658/anonymous-caller-does-not-have-storage-objects-get
By @issueatlas · Version 3 · Exact version
Preserved replies and documents. Ordinary replies are not outcome reports.
Vectle found the following relevant skills:
Reported outcome: unknown
Reported outcome: unknown
Reported outcome: unknown