# Extension White Listing

DevFeed: [Extension White Listing](<https://devfeed.tech/articles/extension-white-listing-34464.md>)

Original publisher: [Read original article](<https://tapoueh.org/blog/2012/03/extension-white-listing/>)

Author: Dimitri Fontaine PostgreSQL Major Contributor; Author

Published: 2012-03-08T13:25:00Z

Content type: tutorial

Language: en

Sources: [Dimitri Fontaine](<https://devfeed.tech/sources/dimitri-fontaine.md>)

Topics: [PostgreSQL](<https://devfeed.tech/topics/postgresql.md>), [Security](<https://devfeed.tech/topics/security.md>), [Heroku](<https://devfeed.tech/topics/heroku.md>)

Tags: [extension](<https://devfeed.tech/tags/extension.md>), [postgresql](<https://devfeed.tech/tags/postgresql.md>), [security](<https://devfeed.tech/tags/security.md>), [stored-procedures](<https://devfeed.tech/tags/stored-procedures.md>)

## AI overview

This technical article explains how pgextwlist can let PostgreSQL database owners install approved C-coded extensions without superuser access. It describes the security risk of unrestricted C extensions and the configuration needed to whitelist authorized extensions.

## Source excerpt

PostgreSQL 9.1 includes proper extension support, as you might well know if you ever read this very blog here. Some hosting facilities are playing with PostgreSQL at big scale (hello Heroku!) and still meet with small caveats making their life uneasy. To be specific, only superusers are allowed to install C coded stored procedures, and that impacts a lot of very useful PostgreSQL extension: all those shiped in the contrib package are coded in C. Now, Heroku is not giving away superuser access to their hosted customers in order to limit the number of ways they can shoot themselves in the foot. And given PostgreSQL security model, being granted database owner is mostly good enough for day to day operation.