More obvious clarification is needed about how RLS interacts with views

PG Doc comments form <[email protected]>
Newsgroups gmane.comp.db.postgresql.devel.documentation
Message-ID <[email protected]>
The following documentation comment has been logged on the website:

Page: https://www.postgresql.org/docs/11/sql-createpolicy.html
Description:

It's not clear enough from reading the documentation on RLS security policy
that schema designers need to pay special attention to views and their
ownership.  (Views will bypass RLS security in the common case that they are
owned by a super user.)  I have seen this misunderstanding lead to
unexpected data exposure.

This *is* clarified at the very bottom of the Notes section on the `create
policy` document, but I believe it justifies having a clear and prominent
call out.  Thank you!
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.