4 ms·
> Good ORMs help tremendously with maintainability and security. ORMs don’t help with security compared to query builders or even typed text.
by minitech 9y ago
> Good ORMs help tremendously with maintainability and security.
ORMs don’t help with security compared to query builders or even typed text.
- icebraining 9y agoSecurity is not just about injection. The ORM we use automatically applies security access rules to the queries, for example.
- zimpenfish 9y ago> The ORM we use automatically applies security access rules to the queries, for example. But surely that's better handled in the database itself?
- icebraining 9y agoHow would you apply user-configured security rules in the database?
- zimpenfish 9y agoGood question. It would depend what kind of rules they were and how they were configured. Wasn't specified that they were "user-configured" in the original statement, though.
- icebraining 9y agoFair enough, ours are :) The kind of rules we use are boolean expressions that identify which rows the user's groups can read/write/delete. The ORM automatically combines all the rules as a single expression and applies it to the query.
- zimpenfish 9y agoAs best I can tell, Postgres lets you do this albeit constraining your boolean checks to things you can efficiently do in the database. But then I can definitely see how this could get unwieldy very quickly. https://www.postgresql.org/docs/9.5/static/ddl-rowsecurity.html https://www.postgresql.org/docs/9.5/static/ddl-rowsecurity.h...
- icebraining 9y agoI know about row-level security, but I don't think the rules can be dynamically loaded.