3 ms·
How much should one trust RLS? Reading PostgREST, it looks like you could use a JWT parameter to enforce a policy - whether individual user or group based. I r
by anonymouse008 2y ago
How much should one trust RLS? Reading PostgREST, it looks like you could use a JWT parameter to enforce a policy - whether individual user or group based.
I really love the idea of RLS, but wonder at it's provable security properties.
- seveibar 2y agoNot an expert but my impression is that RLS is not only rock solid, but extremely more testable since you can construct sql queries that test virtually any access scenario
- XzAeRosho 2y agoRLS is rock solid. That's what Supabase leverages to create access policies and more. They have a very good example of how it works and how powerful it is in their docs: https://supabase.com/docs/guides/database/postgres/row-level-security https://supabase.com/docs/guides/database/postgres/row-level...
- cryptonector 2y agoLast I looked (several versions ago) RLS for `UPDATE`s was not great. Checking now... I see the same problem remains for `UPDATE`s, that you can't see old and new values for the affected row in the policy code. The workaround, when you need to see the old and new values, is to use a `TRIGGER`.
- deleted 2y ago[deleted]
- cryptonector 2y agoYou don't have to use RLS. You can do permissioning in VIEWs and TRIGGERs.