Neon’s Data API can let a browser send requests straight to a Neon database through a REST interface, without a custom application server in the request path. That does not eliminate the backend’s security responsibilities: authentication, SQL privileges, PostgreSQL row-level security (RLS), and any database functions still determine what a caller can do. A September 2026 task-board case study reports 27 refused hostile requests against one implementation, not an independent security audit or proof that any RLS setup is safe.
What “no backend” means in this architecture
In a conventional web application, a browser calls an application server, which verifies identity, applies authorization rules, and queries the database. With Neon Data API, the browser can call a REST interface over a Neon branch database instead. Neon describes the interface as PostgREST-compatible. Its API reference identifies two authentication-provider choices: built-in Neon Auth or an external JWT provider configured with a JWKS URL.
As an Amazon Associate I earn from qualifying purchases.
The application server is absent from that request path, but the authorization boundary is not. Identity has to be established, the database role and SQL privileges must limit available operations, and RLS policies must constrain rows for roles subject to those policies. Schema design and database functions also matter because they can expose data or change the effective privilege context.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Keep the product names distinct: Neon’s product announcement explicitly says that “Neon RLS” is not the same as PostgreSQL Row-Level Security. PostgreSQL RLS is a database feature that applies policies to rows; Neon’s Data API and authentication configuration are separate pieces of the architecture.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Which security layer answers which question?
| Layer | Question it answers | What it does not replace |
|---|---|---|
| Authentication | Who is making the request, as established by the configured identity provider and signed identity information? | It does not by itself authorize access to a particular table, operation, or row. |
| SQL privileges and roles | Which database operations and columns are available to the effective database role? | Broad grants can expose operations even when row policies exist; grants are not a substitute for row-level rules. |
| PostgreSQL RLS | Which rows a role subject to RLS may select, insert, update, or delete? | It does not override SQL privileges, apply automatically to every table, or constrain roles that bypass it. |
| Functions and schema design | What data a database function returns and under whose effective privileges it runs? | A table’s policies do not automatically make every function safe; functions need a separate review. |
PostgreSQL describes row policies as an additional layer to the SQL-standard privilege system. A caller needs the relevant table or column privileges as well as permission to reach the intended rows.
How PostgreSQL RLS behaves
Policies are opt-in, then default-deny without a match
Tables do not have RLS policies by default. After RLS is enabled, a role subject to it can access only rows permitted by an applicable policy; if no policy allows an operation, normal row access is denied. Table owners typically bypass policies unless the table is configured to force them to be subject to RLS. Superusers and roles with the BYPASSRLS attribute bypass policies.
USING and WITH CHECK control different sides of a change
A policy’s USING expression limits existing rows a command can see or act on. WITH CHECK constrains rows created by an insert or produced by an update. PostgreSQL documents cases where a matching WITH CHECK is implicit when omitted, but that behavior is not a reason to leave write policies unexamined: verify the effective policy for each command and role.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Multiple policies can broaden access
PostgreSQL combines permissive policies with OR and restrictive policies with AND. That means adding a permissive policy can make more rows accessible, even if another policy appears narrow. Review the full set of applicable policies together rather than judging a single policy in isolation.
RLS has important boundaries
- Referential-integrity checks, including unique and primary-key checks and foreign-key checks, bypass row security. Poorly designed constraints and error behavior can therefore create covert channels.
- Policies that consult other rows or tables can encounter race conditions. PostgreSQL documents cases where concurrent updates let a policy evaluation use data from an earlier snapshot.
- Table owners and bypass roles sit outside normal policy enforcement unless the applicable configuration changes that behavior. Review which role the API actually uses for queries.
What the 27-request case study tested
In a September 25, 2026 article, the DevOps Daily Team described a multi-tenant task board built with static frontend files, Neon Auth, the Neon Data API, PostgreSQL policies and grants, and a database function. The team reported 27 refused hostile requests: 25 cross-tenant attempts by an owner from another organization and two attempts by a user whose role was wrong within the target organization.
Reported attack categories included crafted filters, embedded joins, aggregate counts, forged-token attempts, bulk updates, and upserts targeting another tenant’s identifiers. The article says its harness checked expected responses and compared victim-row columns before and after the attempts. These are the team’s reported results for that application and test harness; the report does not establish that the requests were independently reproduced or that other schemas and policies would behave the same way.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The break tests reveal why the layers matter
The same article describes four deliberate failure configurations, with three triggering the expected attack behavior:
Recommended Free Tools
- Disabling RLS on a comments table exposed rows and allowed an in-tenant role violation.
- A
SECURITY DEFINERsummary function without a tenant filter leaked counts. - A permissive insert check alone did not enable the tested cross-tenant insert when column-level grants prevented clients from setting the tenant field.
- Combining that weak insert check with broad table-wide grants allowed a cross-tenant insert.
The column-grant result is useful evidence that privileges can provide an additional barrier in that specific implementation. It does not show that column grants generally compensate for incorrect policies. The broader lesson is to test grants and policies as a combined system and to audit functions independently.
Membership changes and already-issued tokens
The case-study team reported that a removed member’s previously issued token remained usable in its tested setup during the token’s remaining lifetime. The report describes a 900-second token validity setting and an observed delay of about 28 seconds; those figures are configuration-specific observations from that article, not a general Neon Auth revocation guarantee. The team says a live membership check in the policy addressed the issue.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For an application where membership removal must take effect promptly, decide explicitly whether authorization depends only on claims already embedded in a token or also checks current membership data. Verify the token and revocation behavior for the exact Neon Auth or external-JWT configuration in use; the case study does not establish universal token semantics.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Direct Data API or a custom application server?
This is an architectural choice, not a claim that one pattern is always safer. Direct access removes a custom server from the request path and puts more of the authorization boundary in database roles, grants, policies, and functions. A custom server can centralize application logic, but it still needs correct authorization and database protections. The choice should turn on who owns each security control and how changes are tested.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Decision point | Direct Data API path | Custom application-server path |
|---|---|---|
| Where identity is verified | By the configured authentication provider and the Data API’s identity integration. | By the application server’s authentication flow; its exact design is implementation-specific. |
| Where row authorization lives | Primarily in PostgreSQL roles, grants, and RLS policies. | May be implemented in server logic, database controls, or both. |
| Who can alter the boundary | People and processes with authority to change roles, grants, policies, schema, and functions. | People and processes with authority over server code and its database access, as well as database controls. |
| Membership removal and existing claims | Must account for the configured token semantics and whether policies check current membership. | Must account for the server’s session, token, and authorization-cache behavior. |
| Functions and effective privileges | Database functions exposed through the data surface need their own privilege and tenant-scope review. | Server code may avoid exposing some functions directly, but any functions it calls still need review. |
| Change and attack testing | Test hostile requests against grants, policies, functions, and schema changes together. | Test server authorization and database controls together, including changes to either layer. |
A practical review checklist before exposing tables
- Map the request identity to a database role. Confirm which identity provider is configured, what signed claims reach the database, and which role executes each request. Do not treat a valid token as proof of row authorization.
- Inventory exposed objects and privileges. For every table, view, and callable function reachable through the API, inspect table- and column-level grants as well as role membership. Prefer the narrowest grants compatible with the application.
- Enable and inspect RLS table by table. Confirm RLS is enabled where tenant data is stored, identify owners and any bypass roles, and verify whether owner access is subject to policies where required.
- Review policies as a set. Check each operation’s
USINGandWITH CHECKbehavior, policy roles, and permissive/restrictive combination. Test inserts and updates that attempt to change tenant identifiers, not just reads. - Audit functions separately. Pay particular attention to
SECURITY DEFINERfunctions, tenant filters, effective privileges, and the data returned by aggregates. A table policy should not be assumed to constrain a function’s result. - Test tenant and role boundaries with hostile inputs. Include filters, joins, counts, bulk writes, upserts, forged or invalid tokens, and identifiers belonging to another tenant. Check stored victim-row values as well as HTTP responses.
- Test removal and concurrent changes. Establish what happens to previously issued tokens after membership changes and consider policies that consult mutable membership tables. Review PostgreSQL’s documented race-condition and integrity-check caveats when designing constraints and policy expressions.
- Recheck after schema changes. Neon’s API references include operations for creating and updating Data API configuration, including a schema-cache refresh operation. Treat schema exposure and cache refresh as part of the deployment process, and verify the current API reference for the exact operation rather than assuming a changed schema is immediately reflected.
What the evidence supports
The case study supports a bounded conclusion: in one reported task-board implementation, a team says its harness refused 27 hostile requests, while deliberate changes to RLS, function filtering, and grants exposed concrete failure paths. PostgreSQL’s documented rules explain why those outcomes are plausible and why grants, RLS, bypass roles, functions, constraints, and concurrent updates all deserve attention.
It does not establish that Neon Data API is secure by default, that RLS prevents every attack, or that another application can reproduce the result by copying a policy. A browser-facing database API can be a workable architecture when its database boundary is designed and tested as the application’s authorization layer; “no backend” is a deployment shape, not a security property.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
