2 ms·
This still sounds nuts. It lets the web client (controlled by the user, which in this context is pronounced "attacker") do any db queries/updates that the back
by throwaway81523 5y ago
This still sounds nuts. It lets the web client (controlled by the user, which in this context is pronounced "attacker") do any db queries/updates that the backend application in a normal app stack could. Who wants to write their whole app in browser JS anyway? Even if you do want to do that, do you end up having to write the sensitive parts it as psql stored procedures to stop the client from pwning the database?
- Izkata 5y agoI haven't used it myself, but my understanding was that it relies on two things to keep data safe: * Postgres has a pretty extensive role/permission system that PostgREST uses to prevent users from accessing rows they're not supposed to see: https://postgrest.org/en/v9.0/auth.html#users-and-groups https://postgrest.org/en/v9.0/auth.html#users-and-groups * The tables aren't necessarily what you want to expose anyway, you can prevent access to tables directly and use functions and views as the interface instead: https://postgrest.org/en/v9.0/schema_structure.html#functions https://postgrest.org/en/v9.0/schema_structure.html#function...