Database roles can read request headers queued by pg_net

当你调用 net.http_get、net.http_post 或 net.http_delete 时，pg_net 会把请求存储为 net.http_request_queue 中的一行。这行记录会保存 URL、头信息和请求体，直到 pg_net 的工作进程发送请求为止。任何可以使用 pg_net 的角色在等待期间都能读取这一行，包括带有 Authorization 或 apikey 头的请求。有关哪些角色可以使用 pg_net，请参见 撤销对 pg_net 对象的访问权限没有效果。

🌐 When you call net.http_get, net.http_post, or net.http_delete, pg_net stores the request as a row in net.http_request_queue. The row holds the URL, headers, and body until the pg_net worker sends the request. Any role that can use pg_net can read the row while it waits, including an Authorization or apikey header. For which roles can use pg_net, see Revoking access to pg_net objects has no effect.

检查一下你的请求暴露了什么 #

🌐 Check what your requests expose

要查看待发送的请求，请在 SQL 编辑器 中运行以下命令：

🌐 To see the requests waiting to be sent, run the following in the SQL Editor:

1
select id, url, headers
2
from net.http_request_queue
3
order by id;

当工人处理请求时，它会从队列中删除一行，所以大多数行存在的时间都很短。当工人落后或停止时，行会在队列中停留更久。

🌐 The worker deletes a row from the queue when it picks up the request, so most rows exist for a short time. Rows stay in the queue for longer when the worker falls behind or stops.

要查看已保存的回复，请运行：

🌐 To see the stored responses, run:

1
select id, status_code, headers, content, created
2
from net._http_response
3
order by created desc
4
limit 20;

net._http_response 会保留状态码、响应头和响应体，至少保存 pg_net.ttl 设置的时间，默认是 6 小时。处理请求的时候，工作线程会删除过期的响应，所以在没有请求发送时，响应可能会保留得更久。它不会存储请求头。也要检查响应体，因为 API 自身可能会返回敏感数据。

请求头中的凭证 #

🌐 Credentials in request headers

通过 pg_net 发送的任何凭证，都应该当作可以被连接到你数据库的每个角色读取。从 Vault 读取凭证可以让它在静态时保持加密，但解密后的值会像其他头信息一样写入 headers 列。

🌐 Treat any credential you send through pg_net as readable by every role that can connect to your database. Reading a credential from Vault keeps it encrypted at rest, but the decrypted value is written to the headers column like any other header.

队列的行级安全 #

🌐 Row Level Security on the queue

你不能在 net.http_request_queue 或 net._http_response 上添加行级安全策略。supabase_admin 角色拥有这两张表，只有表的拥有者才能在表上启用行级安全。Supabase 不支持对这些表在单个项目中更改权限或策略，所以把它们当作一个平台限制吧。

🌐 You can't add Row Level Security policies to net.http_request_queue or net._http_response. The supabase_admin role owns both tables, and only a table's owner can enable Row Level Security on it. Supabase doesn't support changing the grants or policies on these tables for individual projects, so treat them as a platform constraint.