4 ms·
A number of users mentioned removing middleware from their applications and using this db directly. Out of curiosity, how would one hide the db structure and s
by togasystems 16y ago
A number of users mentioned removing middleware from their applications and using this db directly.
Out of curiosity, how would one hide the db structure and secure it from malicious users in a javascript app?
- david927 16y agoI'm have competing technology that does this. First, you have to set permissions carefully, of course. Then, if you don't mind users knowing elements of your schema, you can simply make direct calls from Javascript. If you do mind, you could create stored procedures. Or in the case of our technology, you can also place server-side Javascript on the database and call that.
- togasystems 16y agoInteresting. So one would have to use the db permissions for each user instead of one db user approach of modern web apps. I guess all of the Man in Middle security considerations would still apply. Does you service/users use triggers as security as well?
- david927 16y agoIt can be role based, so you could still have one role for all users, such as view and insert only for a forum. But our solution has an interesting twist: security is managed like queries. For example, taking a sports social network, a team's messages can be sent [an insert] by team members, but seen [view rights] by members of the team and their friends. This is all set with two statements. It makes it so that you can go more often just directly to the database.