Hacker News Reader

Comment by exelib | Hacker News Reader

In short, they aren't really comparable. The thing is, you use postgres RLS for DB users (or give access to an app). But hasura ACL is for app users.

View on HN

People do use RLS for app user-level access control. It has been advocated by PostgREST for years [1] and also widely practiced by the PostGraphile community [2]. Hasura distinguishes itself by not actively advocating db-level access control. From what I recall, the first versions of Hasura were created at a time when Postgres' RLS was still very slow, but it's not clear to me why they still push their own solution. (Not saying there can't be a good reason for it, just not clear to me what it is, and I'd rather default to using functionality built into the database.)

[1] https://postgrest.org/en/stable/auth.html#roles-for-each-web... [2] https://www.graphile.org/postgraphile/security/

But for column level permissions views are still needed, right? This isn't the case with hasura. (Of course hasura's approach has own limitations).

> Anyone accessing the generated API endpoint for the chat table will see exactly the rows they should, without our needing custom imperative server-side coding.

That looks like a bad joke. It is imperative, but now in the database. I'm not sure that it is better. Hasura's approach is declarative.

From my point of view, postgres' security model is still not suitable for users. It is more complex, imperative, and therefore more error prone. Hasura's approach is still not perfect, but a combination of postgres and hasura functionality make a huge difference.

Reply on news.ycombinator.com