Comment by michelpp | Hacker News Reader

Comment by michelpp | Hacker News Reader

Parent Full thread

> then all those production systems do it wrong.

I agree!

Let's put aside that being the OWNER of a database object means that by default is granted all privileges to it, and that owners aren't (typically) filtered by Row Level Security.

Google "Django Postgres Tutorial" and the first link creates a superuser:

https://www.enterprisedb.com/postgres-tutorials/how-use-post...

The second link does not, but then it goes on to `GRANT ALL PRIVILEGES ON DATABASE` to that user:

https://www.section.io/engineering-education/django-app-usin...

The documentation has a handy guide on creating superusers through the web interface, and touts what a great feature it is!

https://djangocentral.com/creating-super-user-in-django/

To a security conscious DBA, this is insanity. Yes, you can lock down a Django app just like PostgREST in fact, and add some code to do SET ROLE and all that just like PostgREST, but no one does because the documentation on database setup in the Django does doesn't even mention superusers:

https://docs.djangoproject.com/en/3.2/ref/settings/#std:sett...

let's not put it aside. i find it perfectly reasonable that the DB user django uses to connect to its own database has all privileges to that database.

there are ways to limit these privileges depending on the requirements both on django and postgres level, for example to have some read only users, etc.

don't google "Django Postgres Tutorial", the only django tutorial you need is the official django tutorial.

the djangocentral article discusses django superusers, not postgres ones. a django superuser has no postgres superuser privileges, they are 2 different things.

> Django does doesn't even mention superusers

of course it does not mention superusers because django does not recommend creating db superusers for security reasons and it mentions them only in connection with installing postgres extensions, and that is a limitation of postgres, not django.

in my professional opinion a run of the mill web application does not need row level security, setting up schema-wide privileges correctly is hard enough. but if one needs it, it's one google search away that some people have tried to do it with django as well, it's a postgres concept and as such can be implemented in any other framework connecting to it.

Reply on news.ycombinator.com