Subject: Rendezvous variables: safe to pass an access token between two extensions?

From: vaibhave postgres <[email-masked]>
Date: Thu, 9 Jul 2026 16:06:58 +0530

Hi all,

Extension A receives an access token and needs to hand it to extension B,
which publishes a handler function via a rendezvous variable
(find_rendezvous_variable).

Since rendezvous variables are just a global, name-keyed void * with no
notion of who populated the slot, is it safe to pass a sensitive value (the
token) this way? My worry is that another loaded module could register the
same name and receive the token instead of the intended extension B.

Is there a supported way to verify the publisher of a rendezvous variable,
or is there a better way to do this? Any prior art would help.

Thanks.

---

From: Andreas Karlsson <[email-masked]>
Date: Thu, 9 Jul 2026 12:44:19 +0200

On 7/9/26 12:36, vaibhave postgres wrote:
> notion of who populated the slot, is it safe to pass a sensitive value 
> (the token) this way? My worry is that another loaded module could 
> register the same name and receive the token instead of the intended 
> extension B.
> 
> Is there a supported way to verify the publisher of a rendezvous 
> variable, or is there a better way to do this? Any prior art would help.

As PostgreSQL extensions are not sandboxed and therefore can access the 
full memory of the backend (including shared memory) I do not think this 
is really a concern specific to rendezvous variables. If an extension 
wants to steal an access token it can as it can just grab them form 
anywhere in the process memory.

You need to either audit all extensions you load or trust your packagers 
and extension authors. If you load extensions you do not trust they can 
do anything the postgres process can do.

-- 
Andreas Karlsson
Percona