Re: view and column rights

"Jean-Yves F. Barbier" <12ukwn(at)gmail(dot)com> writes:
> I read a lot about DBs and some specialists say that I must not give
> direct data (table) access to users but always through a view.

I don't believe that idea is meant to offer added security. What it is
said to be good for is isolating your applications from future changes
in the definition of the underlying table. I think its actual
usefulness for that is pretty limited, though.

Because PG lacks automatically-updatable views, it's difficult to
recommend this approach except for cases where the users need only
read-only access. Otherwise you're going to be trying to rely on
rules to handle update cases, and you'll be in for a world of pain.
The rule mechanism is full of gotchas.

Personally I'd skip the insulating-view idea in nearly all cases.

regards, tom lane