4 ms·
> For instance, adding a join to some ACL table with conditions to exclude entities the client is not authorized to access. This specific thing is better done
by nextaccountic 6y ago
> For instance, adding a join to some ACL table with conditions to exclude entities the client is not authorized to access.
This specific thing is better done with row-level security (in postgres at least). This requires that each user have a role in the db and that all queries be done in transactions that switch to the relevant role; but this seems to be a best practice anyway.
- ivan_gammel 6y agoI cannot imagine this as a best practice, given that you will have to synchronize two identity and access management systems - the one on the frontend and the one in Postgres. Compared to ACL or filtering of results in the service tier via something like Spring Security, it’s too much overhead for such task.