Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchA PostgreSQL view can expose rows that a caller’s own row-level security (RLS) policy would hide. By default, PostgreSQL checks access to a view’s underlying relations using the view owner’s privileges, and applies that owner’s RLS policies to protected base tables. To make underlying permissions and policies follow the invoking user, use security_invoker = true—while also checking for RLS bypass roles and table ownership.
Why a view can show rows hidden by a caller’s policy
PostgreSQL views use a rewrite mechanism to incorporate the view’s query into the caller’s query. By default, privileges on underlying relations are checked using the view owner’s privileges. When an underlying table has RLS enabled, PostgreSQL ordinarily applies the view owner’s policies, not the invoking user’s. If the owner’s policy context permits rows the caller’s policy would reject, those rows may be visible through the view.
As an Amazon Associate I earn from qualifying purchases.
This is the documented default, not a rule that every view always disables RLS. PostgreSQL’s documentation states: “If any of the underlying base relations has row-level security enabled, then by default, the row-level security policies of the view owner are applied, and access to any additional relations referred to by those policies is determined by the permissions of the view owner.” (PostgreSQL 18 CREATE VIEW documentation)
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →A tenant-policy example
Suppose accounts has a policy such as USING (tenant_id = current_setting('app.tenant_id')::int), and a view over that table is owned by a role whose policy context can see every tenant’s rows. With a normal view, the base table’s RLS evaluation uses the view owner’s identity and context. A caller whose own policy would restrict results to one tenant could therefore see additional rows through the view.
#1 Best Overall
The exact result depends on the policies, role attributes, ownership, and session settings in the deployment. The important audit question is not just whether RLS is enabled on the table; it is which role PostgreSQL uses when the table is reached through the view.
Choose the view option that matches the security boundary
| View configuration | Underlying privileges and RLS identity | What it is for | Caller permissions |
|---|---|---|---|
| Default view | View owner | Lets the view operate on underlying relations using the owner’s privileges | Callers generally need permission to use the view; underlying relation access is checked with the owner’s privileges |
security_invoker = true |
Invoking user | Makes underlying relations use the caller’s privileges and policies, as if referenced directly in the query | The caller also needs the relevant underlying relation privileges |
To have the caller’s own table privileges and RLS policies govern access through a view, create or alter it with security_invoker = true. For example:
Rank #2
CREATE VIEW tenant_accounts WITH (security_invoker = true) AS
SELECT account_id, tenant_id
FROM accounts;For an existing view, the corresponding option can be changed with ALTER VIEW:
ALTER VIEW tenant_accounts SET (security_invoker = true);Grant callers the underlying table privileges they need as well as permission to access the view. If they lack those base-relation privileges, a security-invoker view may fail rather than provide the intended result. See the CREATE VIEW documentation for the version-specific syntax and behavior.
Do not confuse security_invoker with security_barrier
security_invoker controls whose permissions and RLS policies apply to underlying relations. security_barrier addresses a different concern: it affects predicate evaluation order to guard against information leaks through unsafe expressions. It does not switch policy evaluation from the view owner to the caller.
| Option | Controls | Does not do |
|---|---|---|
security_invoker |
Identity used for underlying relation privileges and RLS | Override superuser, BYPASSRLS, or table-owner bypass rules |
security_barrier |
Predicate ordering and protection against certain expression-based information leaks | Change which role’s RLS policies apply |
Setting security_barrier alone is not a fix for a view that uses the wrong policy identity. The PostgreSQL documentation describes these options separately in its CREATE VIEW reference.
Check RLS bypass rules even with a security-invoker view
A caller-based view does not cancel PostgreSQL’s general RLS bypass rules. Superusers and roles with the BYPASSRLS attribute bypass RLS. A table’s owner normally bypasses policies on that table too. If the table owner should be subject to RLS, use ALTER TABLE ... FORCE ROW LEVEL SECURITY; this changes the table-owner case, not the superuser or BYPASSRLS exceptions.
These rules apply to the role PostgreSQL uses to reach each table. In a default view, that may be the view owner; with security_invoker = true, it is the invoking user. Check both roles’ attributes and their relationship to every protected table. PostgreSQL’s row security documentation explains the bypass behavior.
Audit an existing view and its dependencies
- Identify the view owner. Check who owns the view, because the owner’s privileges and policy context govern underlying relations by default.
- Inspect the view options. Determine whether
security_invokerandsecurity_barrierare set. Treat them as separate controls with different purposes. - Inspect every base table. Confirm whether RLS is enabled and review the policies that apply to relevant roles. Include relations referenced by policy expressions.
- Check role attributes and table ownership. For the view owner and intended callers, check superuser and
BYPASSRLSstatus, and determine who owns each protected table. - Check FORCE ROW LEVEL SECURITY. If table-owner policy enforcement is intended, verify that the table has been configured with
FORCE ROW LEVEL SECURITY. - Follow nested views. Inspect views referenced by other views. An underlying security-invoker view retains caller-based checking when reached through an outer view.
- Verify the installed PostgreSQL version. Confirm the major and minor version before relying on syntax or assessing a release-specific security issue.
PostgreSQL 18 documentation describes the default owner-based behavior, and PostgreSQL 14 documentation already described the underlying privilege behavior; this is not a new PostgreSQL 18 change (PostgreSQL 18 CREATE VIEW; PostgreSQL 14 CREATE VIEW).
Separate the default behavior from planner security fixes
PostgreSQL 17.6 release notes describe CVE-2025-8713, a specific planner-time permission-check issue: a view owner’s permissions could satisfy an initial security check before a leaky function was applied to underlying table statistics. The fix moved view security checks to the start of planning. That issue is distinct from the ordinary rule that a default view uses its owner’s RLS policies for underlying tables. Consult the PostgreSQL 17.6 release notes and verify the installed release when evaluating exposure.
PostgreSQL 11.3 release notes also document a historical RLS bypass involving selectivity estimators. That separate fix illustrates that planner interactions can create their own security issues; it is not the explanation for the normal view-owner policy behavior described above (PostgreSQL 11.3 release notes).
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
