Re: RLS without leakproof restrictions? - Mailing list pgsql-general

From Tom Dunstan
Subject Re: RLS without leakproof restrictions?
Date
Msg-id CAPPfruxgVOfb5FggGKYJB+dY0=pHuUOOjpR8MYR9zzbHj7uW7g@mail.gmail.com
Whole thread Raw
In response to Re: RLS without leakproof restrictions?  (Tom Lane <tgl@sss.pgh.pa.us>)
List pgsql-general
Hi Tom!

On Wed, 22 Feb 2023 at 14:16, Tom Lane <tgl@sss.pgh.pa.us> wrote:
If you're happy allowing the application to decide if the filters will
be enforced, maybe just create some views embodying those filters, and
query those views when you want restrictions?

Yeah, thanks very much for the suggestion. It's more maintenance than RLS policies as we'll need to update views as tables are modified, and we'll need to ensure that the app never selects from the underlying table, but it still beats needing to add filter clauses across the codebase.

Thanks

Tom

pgsql-general by date:

Previous
From: Tom Lane
Date:
Subject: Re: RLS without leakproof restrictions?
Next
From: Neethu P
Date:
Subject: Event Triggers unable to capture the DDL script executed