PostgreSQL Security for Application Developers
summary
Recommends a concrete permission model: create read-only/DML/DDL split accounts, revoke public schema defaults and set default privileges so new tables inherit correct grants; keep DDL credentials out of runtime environment variables. Emphasizes TLS modes, Java SSL socket factories and certificate pinning (or using a CA chain), and upcoming SCRAM auth in PostgreSQL 10 with server-validation planned for later releases. Calls out a real Node.js driver remote‑code‑execution bug, urges driver updates, always use parameterized queries and escape identifiers, and externalize SQL files.
AI-written summary · about
chapters (31)
- 0:00Introduction
- 1:46Defenseindepth
- 2:45Application Interactions
- 7:00Permissions
- 8:49App User
- 9:17Environment Variables
- 10:27Security
- 11:40Database Drivers
- 12:15PostgreSQL Drivers
- 13:56Update Drivers
- 15:38Transport Layer Security
- 15:58SSL
- 16:38man in the middle
- 18:24SSL overhead
- 18:39SSL modes
- 21:38SSL configuration
- 24:25Certificate pinning
- 25:43Certificate chain
- 27:06Nodejs
- 27:35sequel injection
- 28:37sequel commands
- 28:47literals
- 29:08identifiers
- 29:27fields
- 29:59parameters
- 31:17named parameters
- 32:12escape identifier
- 32:55PostgreSQL format
- 35:14How to avoid sequel strings
- 35:43How to access sequel strings
- 37:46Summary
related talks
32mEnhancing Security in PostgreSQL
07mAll about Postgres security
50mSecuring PostgreSQL
28mFrom Dev to Prod: Securing Postgres the Right Way
27mFor Your Eyes Only: Roles, Privileges, and Security in PostgreSQL
50mPostgreSQL Security. How Do We Think?
42mData Security using Roles, Privileges and Row Level Security
35mSecuring PostgreSQL From External Attack