Re: Connection limit doesn't work for superuser

Tomas Vondra wrote:
> On 11/7/18 5:19 PM, Tom Lane wrote:
> > I think this proposal boils down to asking for support for an
> > incredibly bad application design, and equipping every database with
> > an additional foot-gun in order to have that.
> 
> I'm not sure about that. IMHO being able to restrict the number of
> superuser connections can be used to force users to use regular
> (non-superuser) roles for stuff that does not require that. Which should
> encourage better application design.
> 
> Of course, the question is whether such limit can actually be enforced
> reliably (I mean, can't the superuser simply change it?) and whether
> handing over superuser accounts to application users is a good idea in
> general ...

None of these arguments for enforcing a connection limit for superusers
sound terribly compelling to me.

He who is tempted to run his application with a superuser for
simplicitly's sake will not be the person to set a connection limit
for superusers.

I concur with Tom that this will do more harm than good.

Yours,
Laurenz Albe