4 ms·
I looked at Postgrest and liked what I saw, until it came to authentication and authorization - the docs mention that this is an area that tends to blur the lin
by vosper 10y ago
I looked at Postgrest and liked what I saw, until it came to authentication and authorization - the docs mention that this is an area that tends to blur the line between application and database layer, and then just sort of punts on the whole thing, suggesting that maybe you want to use the auth0 SaaS. Have you had to deal with this?
- icot 10y agoYes, we found the same issue. We worked around this by organizing our application (an admittedly basic REST API) in two layers. The external one exposed to API consumers, developed in a language/framework you may like (Python/Tornado for us), and the internal data access layer which uses Postgrest, and is only accessed locally from within the REST API application servers
- rubber_duck 10y agoWhy not just query the database using standard drivers then ? What am I missing here ?
- spdionis 10y agoMaybe the the exposed application acts like a proxy for the internal apis, only check authentication info and pass on the request to the postgrest servers.
- ruslan_talpa 10y agoI know the docs are lacking but have you guys looked into how roles + RLS + views can work together to solve authorization?
- ruslan_talpa 10y agoYes the docs are lacking but the hope is that the users will get the basic idea and look into things like roles+RLS in the official Postgre docs (although those are lacking too :) it's a very powerful feature, this RLS thing, but since it's new, there are not a lot of examples explaining it)
- ruslan_talpa 10y agoThat is of course until someone finds the time to write a long article/tutorial explaining how all the pieces fit together and how PG 90% of the time can solve all your authorization needs (in regard to the data it stores itself)
- vosper 10y agoIt's more than just roles though - it's validating email addresses at signup, resetting passwords... annoying to build yourself and easy to screw up. In the end I went with Django Rest Framework.
- ruslan_talpa 10y agoValidating email is a CHECK constraint using a regexp on the email filed, resetting password is probably two short stored procedures. I get that you don't usually find code to copy/paste for something like this but it's not hard to implement either (i would say the whole signup/login/reset flow can be done in 100-150 LOC). Out of curiosity, how much time did it take to implement the API you needed?
- cdcarter 10y agoA general rule of thumb is that Identity and Access Management aren't businesses you want to accidentally get into. Yes, you can write IAM code yourself, but at scale it's a way better plan to trust a dedicated IdP.
- deleted 10y ago[deleted]