3 ms·
Is this meant as a proof-of-concept, or a production system? What is stopping me from using Firebug to change the client and issue a 'rm -rf /'-esque command to
by jganetsk 16y ago
Is this meant as a proof-of-concept, or a production system? What is stopping me from using Firebug to change the client and issue a 'rm -rf /'-esque command to Redis? Does Redis have some kind of permission checks? Is there some interesting solution that would provide a thin ACL layer in between the client and Redis?
- mythz 16y agoIt's a proof of concept, but at the same time all redis calls for this service is shielded by strongly-typed web services api (not a free command redis) so the only commands that are executed is what's allowed - the web services api would not be any different than if it was backed by an RDBMS.