
Ask HN: Postgres 9.5 has row level security, should my web users get an account? - andrewstuart
With Postgres row level security it becomes practical to set high level security policies.<p>https:&#x2F;&#x2F;wiki.postgresql.org&#x2F;wiki&#x2F;What&#x27;s_new_in_PostgreSQL_9.5#Row-Level_Security_Policies<p>I&#x27;m thinking of using this in a new web application, giving every user who signs up a Postgres user account, and using that role for every database query.<p>Is there any reason why it would not make sense to do so?
======
anarazel
Note that the RLS implementation in postgres does _not_ require that different
database users are being used.

That's one of several possible ways to use it.

You e.g. alternatively can define a function that sets up a connection's user,
where user refers to a concept of your schema. That's then stored somewhere in
the session's state (trivially e.g. in a temporary table). All the row level
restrictions can then refer to that user.

------
brudgers
It's new. It's shiny. It provides something to learn. Sure.

What problem is it solving? What are the alternatives? What pain does it
inflict? What pain do the alternatives inflict? What are the implications of
removing a layer of abstraction for security, maintenance. and agility as the
project ages?

Good luck.

~~~
andrewstuart
Multi tenancy applications that use a single database to store the data of
multiple organisations (for example CRM data) require strong isolation between
tenants. It is much more reliable and makes for a more simple system if the
isolation is enforced as a database policy rather than saying to the
developers "OK folks, can everyone please never, ever write a query that
doesn't properly WHERE the correct client. No bugs ever please for the
lifetime of this software. Thanks!"

------
justintocci
public website or more like an internal application?

internal apps are an easy yes. a public website requires a few bits to make
sure everything is secure but it can be done safely. be thorough and it'll be
safe.

~~~
andrewstuart
Public.

