Re: Can user specification of a column value be required when querying a view ?

From: Ron Johnson <ronljohnsonjr(at)gmail(dot)com>
To: "pgsql-generallists(dot)postgresql(dot)org" <pgsql-general(at)lists(dot)postgresql(dot)org>
Subject: Re: Can user specification of a column value be required when querying a view ?
Date: 2023-11-21 03:03:06
Message-ID: CANzqJaCcfpS+65ygYfmV9fUqHMrJXzt8r_pmo5hmoK+JxNBOLg@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general

Or row level security.

On Mon, Nov 20, 2023 at 9:25 PM Alan Hodgson <ahodgson(at)lists(dot)simkin(dot)ca>
wrote:

> On Mon, 2023-11-20 at 13:44 -0800, Christophe Pettus wrote:
>
>
>
> On Nov 20, 2023, at 13:41, David Gauthier <dfgpostgres(at)gmail(dot)com> wrote:
> I want the users to be required to provide a value for ssn in the
> following query...
> "select * from huge_view where ssn = '106-91-9930' "
> I never want them to query the view without specifying ssn.
> It has to do with resources and practicality.
>
> Is there a way to do that ?
>
>
> Not in a way that PostgreSQL itself will enforce. If you are concerned
> about a query running wild and taking up resources, setting
> statement_timeout for the user that will be running these queries is the
> best way forward. A user that has general access to PostgreSQL and can run
> arbitrary queries will be able to craft a query that takes up a lot of
> system time and memory without too much trouble.
>
>
> If it's really about SSN's it might be more about bulk access to PII than
> performance.
>
> A function is probably the right choice in either case.
>

In response to

Responses

Browse pgsql-general by date

  From Date Subject
Next Message KK CHN 2023-11-21 06:36:55 Re: pgBackRest on old installation
Previous Message Merlin Moncure 2023-11-21 00:26:32 Re: Prepared statements versus stored procedures