# InfluxQL read-only queries "DROP MEASUREMENT" and "DELETE" **URL:** \ **Category:** InfluxDB 2\ **Tags:** grafana, influxql\ **Created:** [October 25, 2021, 12:22pm UTC](https://community.influxdata.com/t/influxql-read-only-queries-drop-measurement-and-delete/22219 "2021-10-25T12:22:53Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Sian\_Brumm](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/sian_brumm/32/8587_2.png) [@Sian\_Brumm](https://community.influxdata.com/u/Sian_Brumm)\ **Post date:** [October 25, 2021, 12:22pm UTC](https://community.influxdata.com/t/influxql-read-only-queries-drop-measurement-and-delete/22219/1 "2021-10-25T12:22:53Z")
Hello everyone, I am currently running influxdb OSS version 2.0 and I am using grafana version 8.2.1 to visualize my data. My problem is that while using InfluxQL in grafana I am able to drop or delete measurements/ data although I am only using a read-only token for this bucket. This possibility is an huge security problem for my project. From the documentation it appears that “DROP MEASUREMENT” and “DELETE” count as read-only queries (see " InfluxDB OSS 2.0 supports InfluxQL **read-only** queries. See supported and unsupported queries below. To learn more about InfluxQL, see Influx Query Language (InfluxQL)" [Query data with InfluxQL | InfluxDB OSS 2.0 Documentation](https://docs.influxdata.com/influxdb/v2.0/query-data/influxql/)). I’m new to influxdb and would like to know if there is a possibility to prohibit those commands or restrict users rights so that a grafana user cant delete my data. Thank you! ---
**Author:** ![Giovanni\_Luisotto](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/giovanni_luisotto/32/4017_2.png) [@Giovanni\_Luisotto](https://community.influxdata.com/u/Giovanni_Luisotto)\ **Post date:** [October 26, 2021, 9:20am UTC](https://community.influxdata.com/t/influxql-read-only-queries-drop-measurement-and-delete/22219/2 "2021-10-26T09:20:39Z")
I’m not using InflxDB2, but in version 1x I have created a user that has only READ permission on the DB for Grafana. What’s your current user permission? can you run DELETE and DROP successfully even with a user that only has READ permission? (I really really hope the answer is no) I suggest you open an issue on GitHub about this one. (read-only token allows to run DROP and DELETE) ---
**Author:** ![Sian\_Brumm](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/sian_brumm/32/8587_2.png) [@Sian\_Brumm](https://community.influxdata.com/u/Sian_Brumm)\ **Post date:** [October 27, 2021, 6:58am UTC](https://community.influxdata.com/t/influxql-read-only-queries-drop-measurement-and-delete/22219/3 "2021-10-27T06:58:54Z")
I tested everything with the 1.8 version of Influx yesterday. And it works as it should. A user with just read permission is blocked from performing “DROP MEASUREMENT” or “DELETE” queries. However i cant get it work with 2.0 and this new token system. I created a new user and created a read-only token for this user only with read access to this specific bucket (see picture below). Still I am able to delete data with him by running those queries in the raw query mode. I am using the token in the custom http header section with the value: token “myToken” as described in many blogs and tried every combination in the auth details and below in the user and password file. Nothing worked yet. ![influx1](https://us1.discourse-cdn.com/flex023/uploads/influxdata/original/2X/7/7a369d99626f51fc3c9ece44fd0580c27dbefc54.png) ![influx2](https://us1.discourse-cdn.com/flex023/uploads/influxdata/original/2X/3/3a0eeef36457d53da3264fd7466f088eb8959350.png) I will create an issue about this in github too. ---
**Author:** ![Anaisdg](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/anaisdg/32/6401_2.png) [@Anaisdg](https://community.influxdata.com/u/Anaisdg)\ **Post date:** [November 5, 2021, 3:06pm UTC](https://community.influxdata.com/t/influxql-read-only-queries-drop-measurement-and-delete/22219/4 "2021-11-05T15:06:31Z")
@Sian_Brumm, Did you create a feature request? > **[GitHub - influxdata/influxdb: Scalable datastore for metrics, events, and...](https://github.com/influxdata/influxdb)** > > Scalable datastore for metrics, events, and real-time analytics - GitHub - influxdata/influxdb: Scalable datastore for metrics, events, and real-time analytics ---
**Author:** ![Sian\_Brumm](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/sian_brumm/32/8587_2.png) [@Sian\_Brumm](https://community.influxdata.com/u/Sian_Brumm)\ **Post date:** [November 22, 2021, 8:02am UTC](https://community.influxdata.com/t/influxql-read-only-queries-drop-measurement-and-delete/22219/5 "2021-11-22T08:02:29Z")
I opened an issue in github > > > Hello everyone, > > I am currently running influxdb OSS version 2.0 and I am usin…g grafana version 8.2.1 to visualize my data. > > My problem is that while using InfluxQL in grafana I am able to drop or delete measurements/ data although I am only using a read-only token for this bucket. > > I tested everything with the 1.8 version of Influx yesterday. And it works as it should. A user with just read permission is blocked from performing “DROP MEASUREMENT” or “DELETE” queries. > > However i cant get it work with 2.0 and this new token system. I created a new user and created a read-only token for this user only with read access to this specific bucket. Still I am able to delete data by running those queries in the raw query mode of grafana. > > I am using the token in the custom http header section with the value: token “myToken” as described in many blogs and tried every combination in the auth details and below in the user and password area. Nothing worked yet. > > I’m new to influxdb and would like to know if there is a possibility to prohibit those commands or restrict users rights so that a grafana user cant delete my data. > > Thank you!