3 ms·

Interesting project! One question: Does this have any access control built in? Otherwise, anyone could change anything in database from browser.

• kiwicopple 7y ago
  Good question. We will be adding a static API key which is set as an ENV variable. For our hosted service we put this behind an nginx instance that has more robust access control. We’d prefer to keep it this way so the realtime server can remain as simple as possible (and completely stateless)
  • jatins 7y ago
    Ah, okay! My question more on the lines of application level access control. As in how to ensure one user can only modify certain data in a table? For example assuming a social networking site, if entire database is exposed one user could update the profile of other user knowing their user ID. I think firebase used to have a concept of security rules for such things
    • kiwicopple 7y ago
      Aha, gotcha - this elixir server is for subscribing only. For all other CRUD operations I would very highly recommend PostgREST. And yes, Firebase still has that concept. You can achieve the same in postgres with Row Level Security (https://www.postgresql.org/docs/9.5/ddl-rowsecurity.html https://www.postgresql.org/docs/9.5/ddl-rowsecurity.html) although admittedly it's a bit easier on Firebase.
• mildmustard 7y ago
  Yea, I'd be really interested in this. Part of using Firebase Realtime DB was that you can use Firebase Auth with it for access control and set rules on the database based on it.