2 ms·
Good question. We will be adding a static API key which is set as an ENV variable. For our hosted service we put this behind an nginx instance that has more ro
by kiwicopple 7y ago
Good question. We will be adding a static API key which is set as an ENV variable.
For our hosted service we put this behind an nginx instance that has more robust access control. We’d prefer to keep it this way so the realtime server can remain as simple as possible (and completely stateless)
- jatins 7y agoAh, okay! My question more on the lines of application level access control. As in how to ensure one user can only modify certain data in a table? For example assuming a social networking site, if entire database is exposed one user could update the profile of other user knowing their user ID. I think firebase used to have a concept of security rules for such things
- kiwicopple 7y agoAha, gotcha - this elixir server is for subscribing only. For all other CRUD operations I would very highly recommend PostgREST. And yes, Firebase still has that concept. You can achieve the same in postgres with Row Level Security (https://www.postgresql.org/docs/9.5/ddl-rowsecurity.html https://www.postgresql.org/docs/9.5/ddl-rowsecurity.html) although admittedly it's a bit easier on Firebase.