4 ms·
anyone with the privilege to login can see the names and relations of all the entities in the database.
by ruslan_talpa 9y ago
anyone with the privilege to login can see the names and relations of all the entities in the database.
- dragonwriter 9y agoYeah, but if you are using a wrapper similar to this, you can easily prevent that while still using the underlying DB security mechanisms.
- ruslan_talpa 9y agoI'm not arguing using db for authorisation is bad, i was just pointing out the statement is incorrect (about not seeing other tables names). The fact that you can see the schema even without privileges is used by PostgREST and this weirdly contributes to security because the user with which it connects to the database (authenticator) does not need to have any rights, just the right to switch to other (specific) users.
- combatentropy 9y agoYou're right. I'm sorry! I remembered wrong. But that's only if you can first connect to the database with a general-purpose client program, like psql or one of the GUIs. By default Postgres allows connections only from localhost. So even if you had a user account, you couldn't connect. So how would something like this REST interface even work with accounts for each user? The REST program would have to be installed on the same server as Postgres, or you would have tell Postgres to allow network connections only from the server that the REST program is on. The REST program first connects with its own user account, say "resty". resty is a member of your account, say "jdoe" (users and groups are the same entity, and they're really called "roles", and one role can be a member of another role). If a role is member of another role, then it can become it, like this: set role jdoe; Now you been downgraded to the rights of jdoe. The REST program could pass through your username and password and relogin as you. Or it could trust that your web server authenticated the REMOTE_USER and just set itself to that variable.