Search Postgresql Archives

Re: Thoughts on row-level security for webapps?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 31/12/18 6:57 μ.μ., Siegfried Bilstein wrote:
Hi all, 

I'm evaluating using a tool called Postgraphile that generates a GraphSQL server from a postgres setup. The recommended way of handling security is to implement RLS within postgres and simply have the webserver take a cookie or similar and define which user is querying data. 

I've normally built webapps like this: pull out user id from a session cookie -> the API endpoint verifies the user and whether or not it has access to the given data -> app code mutates the data. 

With Postgraphile the request specifies the mutation and the server processes the request and relies on Postgres to determine if the user has correct access rights. 

It seems like I would need to create a ROLE for every single member that signs up for my website which I'm a little concerned about.

Why?

Is this a common usage pattern for SQL security? Any gotchas relying on RLS?

--
Siggy Bilstein
CTO of Ayuda Care


-- 
Achilleas Mantzios
IT DEV Lead
IT DEPT
Dynacom Tankers Mgmt

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Postgresql Jobs]     [Postgresql Admin]     [Postgresql Performance]     [Linux Clusters]     [PHP Home]     [PHP on Windows]     [Kernel Newbies]     [PHP Classes]     [PHP Books]     [PHP Databases]     [Postgresql & PHP]     [Yosemite]

  Powered by Linux