3 ms·
How hard would it be to do the opposite? Expose a postgres API that people can use by sending "SELECT" queries from psql or a postgres connector? Postgres has
by remram 4y ago
How hard would it be to do the opposite? Expose a postgres API that people can use by sending "SELECT" queries from psql or a postgres connector?
Postgres has access control and an extension mechanism. Would the easiest be to use a real postgres server?
- mLuby 4y agoThat's just GraphQL with fewer steps.
- awb 4y agoI thought about this too, but there are a few things to consider: 1) you need to separate any non-queryable data into it’s own table. So you’d need _public and _private tables for most data types 2) any type of filter query will need a JOIN, which leaves you vulnerable to malicious long running queries 3) some tables you don’t want people to run SELECT * on, otherwise they can get your entire site data 4) you need to be really careful with DELETE, UPDATE and INSERT queries to prevent malicious behavior Maybe one way would be to write a bunch of whitelisted regex patterns for allowed queries, but you’re definitely playing with fire allowing someone to send SQL queries to your DB.
- remram 4y agoI'm not sure why you would put data you don't intend to be queried in the same database. As for DoS, I know postgres can impose limits (from having used the crt.sh database, which is available publicly), though I am not sure why you think so many JOINs would be required.
- awb 4y ago> I'm not sure why you would put data you don't intend to be queried in the same database Things like personal user / marketing info, internal data / metrics, etc.
- sigstoat 4y agomaybe foreign data wrappers would be relevant to your interests? i believe there are already a number of them which expose non-databasey things.