How To Dev

Introduction Hashids is a small open-source library that generates short, unique, non-sequential ids from numbers. It helps secure the system by hiding the real database IDs, preventing users from guessing or scraping data via URLs. Advantages: Security: Hides real IDs, preventing exposure of data structure and the total number of records. Two-way transformation: Allows easy encoding and decoding without requiring storage in the database. High customization: Supports minimum length configuration and utilizes a distinct salt value to guarantee the generated strings are unique to your system. No collisions: The exact same ID and salt value will consistently produce the identical unique string. Limitations: Not true cryptography: Hashids does not employ strong encryption algorithms, meaning someone with the salt and the algorithm can still reverse the string. Therefore, do not use it to secure highly sensitive data. Dependency on Salt: If you lose or alter your Salt string, all prev...

Introduction Continuing from the previous article about Function, we will look into how to use it with Security Access Control for efficient privilege management. Suppose you have a table storing sensitive and critical data like accounts, and you want to enforce access control to restrict regular accounts from accessing or updating account information. However, you still want to allow users to perform specific operations such as creating an account or updating a password. In this scenario, you can create a Function with SECURITY DEFINER, allowing users to simply call this Function and pass the corresponding input parameters. INVOKER and DEFINER This is an attribute of a function (or procedure) in PostgreSQL. SECURITY INVOKER is used by default, meaning the function executes with the privileges of the user calling it. It does not exceed the caller's privileges, which reduces security risks. SECURITY DEFINER specifies that the function will be executed with the privileges of the us...

Introduction In this article, I will guide you on how to create an account and apply role assignment following the Principle of Least Privilege, in order to grant only the exact permissions that the application needs. Detail To create a new user, you use -- CREATE USER {username} WITH PASSWORD '{password}'; CREATE USER backend_user WITH PASSWORD 'backend_password' ; -- CREATE ROLE {username} LOGIN PASSWORD '{password}'; CREATE ROLE backend_user LOGIN PASSWORD 'backend_password' ; Here, using CREATE USER is the old syntax, which supports LOGIN by default and it acts as an alias for CREATE ROLE In newer versions of Postgres, you should use CREATE ROLE because it is more flexible If used with LOGIN , it creates a user Without LOGIN , it creates a group role When newly created, the user will by default have no permissions to SELECT data INSERT UPDATE DELETE CREATE TABLE CREATE FUNCTION DROP TABLE EXECUTE function USAGE on schema Instead, they can o...