title: How to create a read-only user in PostgreSQL?
body: <p>I want to create a read-only user in PostgreSQL.</p>
  
  <p>The intention is to have a publicly accessible data explorer, where users can write custom SQL queries.</p>
  
  <p>I do this to create the user:</p>
  
  <pre><code>CREATE USER MyReadOnlyUser WITH ENCRYPTED PASSWORD 'MY_WEAK_PASSWORD';
  
  GRANT ALL PRIVILEGES ON DATABASE "MY_DB_NAME" to MyReadOnlyUser;
  
  GRANT ALL ON SCHEMA public TO MyReadOnlyUser; 
  GRANT SELECT ON ALL TABLES IN SCHEMA public TO MyReadOnlyUser; 
  </code></pre>
  
  <p>The intention is to give the user SELECT access to all tables, then revoke select access on the sensitive tables, and then the user can run custom queries with that db user, without any need for me to sanitize input.</p>
  
  <p>Especially, he may not: </p>
  
  <p><strong>insert, delete, truncate, drop table, drop database, create table, create function/procedure, see/execute/create/drop stored procedure / functions.</strong> etc.</p>
  
  <p>Sooo - now my question:<br />
  Why does this user have access to information_schema ? <br />
  It wasn't granted access to any views, and not to the schema information_schema either...</p>