Skip to content

[DOCS/BUG]: RLS recommends sql.raw for JWT token but breaks if the token contains an apostrophe #4335

Open
@Tigatok

Description

@Tigatok

Enhancement hasn't been filed before.

  • I have verified this enhancement I'm about to request hasn't been suggested before.

Describe the enhancement you want to request

On this page: https://orm.drizzle.team/docs/rls we have an example of using queries with RLS. These queries recommend using:

await tx.execute(sql`
          -- auth.jwt()
          select set_config('request.jwt.claims', '${sql.raw(
            JSON.stringify(token)
          )}', TRUE);

I recently had a user sign into my app, whose session token contained a name value with an apostrophe exTy'ler Marshall.
The sql(raw) spits out raw SQL, but doesn't escape the "'" properly. I was able to avoid this by using:

    await tx.execute(
      sql`SELECT set_config('request.jwt.claims', ${JSON.stringify(jwtClaim)}::text, TRUE)`
    );

But I'm not 100% sure that is equal in functionality. I'm not sure if this is a bug or just a doc enhancement, but afaik this is not just a "my app" thing.

Metadata

Metadata

Assignees

No one assigned

    Labels

    docsImprovements or additions to documentation

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions