[GENERAL] Security Issues: Allowing Clients to Execute SQL in the Backend.

2014-04-30 Thread Hello World
Hello! I'm developing a web application that needs to display data from a postgres backend. The most convenient way for the app to get the data is by expressing the request in SQL. I'm thinking about the following architecture [ App/Client ] -> query in SQL ---> [Web server] ---> same SQL q

Re: [GENERAL] Security Issues: Allowing Clients to Execute SQL in the Backend.

2014-04-30 Thread Hello World
Hello, Thank you very much. Denial of service is indeed a problem. Is there a way to limit the execution time of a request? I'm using libpq to communicate with the server. PS. I've just taken a look, it seems I could do some asynchronous queries, time them, then cancel them if they take too lon

Re: [GENERAL] Security Issues: Allowing Clients to Execute SQL in the Backend.

2014-04-30 Thread Hello World
> SET statement_timeout=0; > SET work_mem=1024GB; > I just realized about the SET command. Isn't it weird that any user can set parameters such as this that will apply server wide? to all future sessions? I noticed that some of the parameters can only be set by superusers, and some require re-st