Python script bypasses PostgreSQL login?

Question

I'm trying to work with a PostgreSQL database I have locally, and for some odd reason the program is able to login and make changes to the database without any username or password. I have done this same process in JavaScript and it required the username and password.

Either way, isn't it extremely strange that this simple python script can use the database without any credentials? Code below.

import psycopg2

user = "";
pw = "";

conn = psycopg2.connect("dbname='log_to_db' user='" + user + "' 
host='localhost' password='" + pw + "'")

cur = conn.cursor()
cur.execute("SELECT * from logs WHERE id=132")
print (cur.fetchall())
conn.close()

So, this script displays a row in the table. If anyone can help me understand why it's gaining access into the database without credentials (in addition to what I need to do to fix it), I would really appreciate it!

what does your pg_hba.conf file look like. that file controls authentication mechanisms, perhaps local connections don't need a login. also, execute the following query from your python script to figure out what postgresql user it is connecting as select user; — Haleemur Ali
– Haleemur Ali, Commented Jan 9, 2018 at 21:04
I am not sure where to find that file. When I did select user it showed me a user that requires a password. I do not understand how it works without a password. — shmob
– shmob, Commented Jan 9, 2018 at 21:08
on unix systems you can search for pg_hba.conf using the find utility. on mine, its inside the directory /etc/postgresql/10/main. On mac, if you install via brew, I think the file ends up in the child of /usr/local/Cellar/postgresql/ — Haleemur Ali
– Haleemur Ali, Commented Jan 9, 2018 at 21:12
For Homebrew-installed PostgreSQL, that file is in /usr/local/var/postgres. By default it defines "trust" for "local" (Unix socket) and "localhost" (127.0.0.1). Note that "localhost" is not in any way network accessible. Change the METHOD column to "md5" to enforce password auth. — bimsapi
– bimsapi, Commented Jan 22, 2018 at 21:59

frostshoxx · Accepted Answer · 2018-01-09 21:08:35Z

2

There are couple possibilities:

Psycopg2 may login to your PostgreSQL via password stored in .pgpass config file
Trust Authentication: this is where your environment login may have been pre-authenticated.
Peer authentication:similar to trust authentication, but geared toward the database being hosted on your machine (i.e., localhost).

Given that your JavaScript code requires login cred to access the DB, #2 and #3 are most likely to be the case.

answered Jan 9, 2018 at 21:08

frostshoxx

5361 gold badge7 silver badges24 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

shmob Over a year ago

how do I verify this? how would I go about changing it?

Collectives™ on Stack Overflow

Python script bypasses PostgreSQL login?

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related