4 ms·
From the website it's unclear how nodes are authenticated. How can one node enforce access control over objects if its connection is proxied?
by bastawhiz 8y ago
From the website it's unclear how nodes are authenticated. How can one node enforce access control over objects if its connection is proxied?
- josemaenzo 8y agoThere is no authentication system in dop. You decide if a client can subscribe to a specific object: https://github.com/DistributedObjectProtocol/web/blob/master/docs/api/javascript/onSubscribe.md#nodes-have-the-object-listener-attached https://github.com/DistributedObjectProtocol/web/blob/master... The same way you would do it with plain WebSockets Also you decide what to do when a client call a specific function: https://github.com/DistributedObjectProtocol/web/blob/master/docs/guide/javascript/remote-procedure-calls.md https://github.com/DistributedObjectProtocol/web/blob/master...
- aaaaaaaaaab 8y agoI guess the server could sign the content.
- bastawhiz 8y agoEven still, if a node is connected to the owner through another (malicious) node, how do you prevent the malicious node from making mutation requests on behalf of the legitimate node? I can see a number of ways that it can be accomplished that would take a good amount of work but it begs the question, is this worth the effort? You now have lots of security concerns, issues with nodes disconnecting, and nodes becoming overloaded. What benefit does this have over plain old fashioned AJAX? What problem does this solve?