added postgrest-docs-linkcheck; clean up links
* removed outdated links * updated permanent redirections * updated postgres docs links to current version * sort links in ecosystems by repo-name * change http:// to https://
This commit is contained in:
committed by
Wolfgang Walther
parent
a1178a8016
commit
92395eae8a
@@ -1,3 +1,5 @@
|
||||
.. _admin:
|
||||
|
||||
Hardening PostgREST
|
||||
===================
|
||||
|
||||
@@ -51,7 +53,7 @@ However it's very easy to delete the **entire table** by omitting the query para
|
||||
|
||||
DELETE /logs HTTP/1.1
|
||||
|
||||
This can happen accidentally such as by switching a request from a GET to a DELETE. To protect against accidental operations use the `pg-safeupdate <https://github.com/eradman/pg-safeupdate>`_ PostgreSQL extension. It raises an error if UPDATE or DELETE are executed without specifying conditions. To install it you can use the `PGXN <http://pgxn.org/>`_ network:
|
||||
This can happen accidentally such as by switching a request from a GET to a DELETE. To protect against accidental operations use the `pg-safeupdate <https://github.com/eradman/pg-safeupdate>`_ PostgreSQL extension. It raises an error if UPDATE or DELETE are executed without specifying conditions. To install it you can use the `PGXN <https://pgxn.org/>`_ network:
|
||||
|
||||
.. code-block:: bash
|
||||
|
||||
@@ -60,7 +62,7 @@ This can happen accidentally such as by switching a request from a GET to a DELE
|
||||
# then add this to postgresql.conf:
|
||||
# shared_preload_libraries='safeupdate';
|
||||
|
||||
This does not protect against malicious actions, since someone can add a url parameter that does not affect the result set. To prevent this you must turn to database permissions, forbidding the wrong people from deleting rows, and using `row-level security <https://www.postgresql.org/docs/current/static/ddl-rowsecurity.html>`_ if finer access control is required.
|
||||
This does not protect against malicious actions, since someone can add a url parameter that does not affect the result set. To prevent this you must turn to database permissions, forbidding the wrong people from deleting rows, and using `row-level security <https://www.postgresql.org/docs/current/ddl-rowsecurity.html>`_ if finer access control is required.
|
||||
|
||||
Count-Header DoS
|
||||
----------------
|
||||
|
||||
Reference in New Issue
Block a user