Regarding the following OWASP Vulnerabilities:
Insecure Direct Object References. By that I mean letting someone see
/account/123/not-theirs(this could be the wrong reference I'm using above).
Can these be solved by using a database that supports Row Level Security and by creating real user accounts in the database for each user and having them login to the database as themselves (via the web server)?
Any issues in this approach to be aware of (other than it killing connection pooling)?
One obviously needs some sort of record access control. How is moving record access control from the web layer to the database layer worse, when it's more centralized? (Databases tend to live longer than applications, and databases sometimes have more than one application.)
User authentication (storage) happens in a different system.
Users are not be superusers and would have the minimum required privileges (by that I mean they can't run command shells in SQL or other silliness).
Users would not have direct db access, only access through a web application.
Would use hierarchical roles.
Would still use parameterized queries, however not all queries are parameterizable, developers make mistakes, and systems like Wordpress have shown that plugins can get you.