Hi all,
I'm evaluating
using a tool called Postgraphile that generates a GraphSQL
server from a postgres setup. The recommended way of handling
security is to implement RLS within postgres and simply have
the webserver take a cookie or similar and define which user
is querying data.
I've normally
built webapps like this: pull out user id from a session
cookie -> the API endpoint verifies the user and whether or
not it has access to the given data -> app code mutates the
data.
With
Postgraphile the request specifies the mutation and the server
processes the request and relies on Postgres to determine if
the user has correct access rights.
It seems like I
would need to create a ROLE for every single member that signs
up for my website which I'm a little concerned about.
