Re: Thoughts on row-level security for webapps?

On 31/12/18 6:57 μ.μ., Siegfried Bilstein wrote:
> Hi all,
>
> I'm evaluating using a tool called Postgraphile that generates a GraphSQL server from a postgres setup. The recommended way of handling security is to implement RLS within postgres and simply have
> the webserver take a cookie or similar and define which user is querying data.
>
> I've normally built webapps like this: pull out user id from a session cookie -> the API endpoint verifies the user and whether or not it has access to the given data -> app code mutates the data.
>
> With Postgraphile the request specifies the mutation and the server processes the request and relies on Postgres to determine if the user has correct access rights.
>
> It seems like I would need to create a ROLE for every single member that signs up for my website which I'm a little concerned about.

Why?

> Is this a common usage pattern for SQL security? Any gotchas relying on RLS?
>
> --
> Siggy Bilstein
> CTO ofAyuda Care <https://www.ayudacare.com>
> Book some time <https://calendly.com/siggy-cto> with me!

--
Achilleas Mantzios
IT DEV Lead
IT DEPT
Dynacom Tankers Mgmt