Suggest pg-safeupdate rather than nginx
This commit is contained in:
@@ -90,11 +90,7 @@ However it's very easy to delete the **entire table** by omitting the query para
|
||||
|
||||
DELETE /logs HTTP/1.1
|
||||
|
||||
This can happen accidentally even just by switching a request from a GET to a DELETE. To protect against accidental operations we can add an Nginx rule to prevent DELETE or PATCH requests which lack a query parameter.
|
||||
|
||||
.. code::
|
||||
|
||||
Nginx stuff goes here
|
||||
This can happen accidentally such as by switching a request from a GET to a DELETE. To protect against accidental operations use the `pg-safeupdate <https://bitbucket.org/eradman/pg-safeupdate/>`_ PostgreSQL extension. It raises an error if UPDATE or DELETE are executed without specifying conditions.
|
||||
|
||||
This does not protect against malicious actions, since someone can add a url parameter that does not affect the resultset. To prevent this you must turn to database permissions, forbidding the wrong people from deleting rows, and using `row-level security <https://www.postgresql.org/docs/current/static/ddl-rowsecurity.html>`_ if finer access control is required.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user