Do not share JWT secret with SQL

src/PostgREST/App.hs

@@ -7,7 +7,6 @@ module PostgREST.App (
 ) where
 
 import           Control.Applicative
-import           Control.Monad             ((>>))
 import qualified Data.ByteString.Char8     as BS
 import           Data.IORef                (IORef, readIORef)
 import           Data.List                 (delete, lookup)
@@ -98,8 +97,6 @@ transactionMode _ = HT.Write
 
 app :: DbStructure -> AppConfig -> ApiRequest -> H.Transaction Response
 app dbStructure conf apiRequest =
-  exposeSecretToSQL (configJwtSecret conf) >>
-
   case (iAction apiRequest, iTarget apiRequest, iPayload apiRequest) of
 
     (ActionRead, TargetIdent qi, Nothing) ->

src/PostgREST/Middleware.hs

@@ -19,7 +19,6 @@ import           PostgREST.ApiRequest          (ApiRequest(..), ContentType(..),
 import           PostgREST.Auth                (claimsToSQL, JWTAttempt(..))
 import           PostgREST.Config              (AppConfig (..), corsPolicy)
 import           PostgREST.Error               (errResponse)
-import           PostgREST.QueryBuilder        (pgFmtLit)
 
 import           Protolude                     hiding (concat, null)
 
@@ -46,11 +45,6 @@ runWithClaims conf eClaims app req =
       ]
       (toS $ "{\"message\":\""<>message<>"\"}")
 
-exposeSecretToSQL :: Maybe Text -> H.Transaction ()
-exposeSecretToSQL mS =
-  for_ mS $ \s ->
-    H.sql $ "set local postgrest.jwt_secret = " <> toS (pgFmtLit s) <> ";"
-
 defaultMiddle :: Application -> Application
 defaultMiddle =
     gzip def

test/fixtures/schema.sql

@@ -194,7 +194,7 @@ CREATE FUNCTION login(id text, pass text) RETURNS public.jwt_token
     LANGUAGE sql SECURITY DEFINER
     AS $$
 SELECT jwt.sign(
-    row_to_json(r), current_setting('postgrest.jwt_secret')
+    row_to_json(r), 'safe'
   ) as token
   FROM (
     SELECT rolname::text, id::text
@@ -227,7 +227,7 @@ CREATE FUNCTION jwt_test() RETURNS public.jwt_token
     LANGUAGE sql SECURITY DEFINER
     AS $$
 SELECT jwt.sign(
-    row_to_json(r), current_setting('postgrest.jwt_secret')
+    row_to_json(r), 'safe'
   ) as token
   FROM (
     SELECT 'joe'::text as iss, 'fun'::text as sub, 'everyone'::text as aud,