For my webservice I use a PostgreSQL database which supports row-level-security to prevent users accessing rows of a table they are not supposed to read/access. I would like to use this functionality to prevent a user accessing data from another user (either due to a bug, altered webservice request, SQL injection, etc).

I understand the purpose is actually meant for a database user, but I am wondering if it is wise or common to create a shadow-user in the database for every "application" user as well. (the database is of course not directly accessed and rather through a WSGI, therefore the shadow user)

FYI: This is technically a XY-problem. For example, my actual intention is to prevent that a user requested his profile and accidentally or corner-case data from another profile gets send back. Row-Level access looked promising

1 Answer 1


Row security policies are general SQL expressions, so you are not required to use database users. However, the policy has to know what the current user is, and this is easier with current_user than with some other setting. (It would be possible to use current_setting('my_app.app_user'), but that requires you to SET this value in every connection, and is not protected against changes made by injected SQL code.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.