3 ms·
There are a couple of key features that PostgREST provides that I have not seen in other web frameworks. That's not to say others don't exist, but there are so
by michelpp 5y ago
There are a couple of key features that PostgREST provides that I have not seen in other web frameworks. That's not to say others don't exist, but there are some definitely modeling and security anti-patterns that have become unfortunately deeply entrenched in many frameworks I've had to work with:
1. Your web framework logging into the database as a superuser.
This is huge: "kitchen-sink" frameworks tend to log into the database as a superuser, typically so they can "do migrations" from some SQL-degenerate ORM.
PostgREST (as documented) logs into the database as a user with NO privileges at all, and switches roles (with SET ROLE) to the role defined in the signed JWT token. If you never sign a token with a superuser role, users can never run queries as a superuser. You can also enforce host based security so that your web servers can't even SET ROLE even if they had a bogus signed token.
2. Buffering full database query responses as garbage collected "objects" and then serialize them to JSON.
Another problem proxy frameworks have is that they compose a SQL query, run it (typically as a superuser, sigh), then buffer then entire response in memory, typically as "objects" that need to be immediately garbage collected, and then rendered into JSON in another buffer! Finally the response is then streamed to the browser.
Postgres speaks JSON, and can produce rows of data as JSON natively. This data can be streamed directly to the browser before the query completes. This is a huge cost. Django workers typically need several gigabytes of RAM, proportional to the largest possible query response your database can produce. PostgREST does no buffering, parsing, or rendering, it just streams the json response directly from the database. Processes typically need only one or two hundred megabytes of RAM at most.
3. Tables and Views are elements of an object oriented type system. Not just a storage mechanisms.
Postgres is an Object-Oriented Relational Database Management System (OORDBMS). Tables are not just places you stick stuff, they are types and rows of data are instances of those types. Views are types composed of sub-types, which can in turn be views or tables. Postgres rewrites a query until all the views are expanded, like macros, until it gets one big query you never have to ever see.
PostgREST leverages all of this power of the database, you can model in the language that is the best for modeling data, SQL.