Your PostgreSQL Query Works. That's Exactly What Makes This Bug Dangerous.

说明与用途

在多租户 SaaS 中，仅依赖应用代码进行租户过滤可能导致数据泄露。Rust 代理验证租户上下文，映射到 PostgreSQL 角色，并与 RLS 一起工作以防止泄露。

问题

Cross‑tenant data leaks can occur when a multi‑tenant SaaS application relies solely on application code for authorization, allowing a missing check to expose another customer’s data without triggering errors.

结果

By inserting a tenant‑verification layer between applications and PostgreSQL, the proxy prevents accidental cross‑tenant data exposure while complementing existing RLS and role grants.

工作流

• 1. Client connects to proxy instead of PostgreSQL directly.
• 2. Proxy verifies signed tenant context during connection startup.
• 3. Proxy rejects invalid, expired, or missing tenant credentials.
• 4. Proxy maps verified tenant identity to a PostgreSQL role.
• 5. PostgreSQL executes query with role‑based access and RLS policies.
• 6. Proxy records operational metrics and attestation logs.

证据

If authorization depends entirely on application code, one missing check could expose another customer's invoice.

来源

I built an open‑source Rust proxy that sits between PostgreSQL clients and an existing PostgreSQL database.

来源

Verify signed tenant context during connection startup.

来源

Work alongside PostgreSQL grants and Row‑Level Security.

来源