3 ms·
So there’s a server which accepts arbitrary writes to the database? And maps HTTP ranges to arbitrary database chunks? Are we just completely relying on the cl
by ninkendo 5y ago
So there’s a server which accepts arbitrary writes to the database? And maps HTTP ranges to arbitrary database chunks?
Are we just completely relying on the client for security here? (i.e. no security at all?) Is this only for use cases where you have a whole database per user, and effectively a single security domain for the whole db? Because otherwise it smells very insecure to me…
- sekao 5y ago> So there’s a server which accepts arbitrary writes to the database? No, all writes have to go through a normal POST endpoint, it does not accept arbitrary writes from clients.
- ninkendo 5y agoIs the POST endpoint accepting database chunks (symmetrical to the GET endpoint?) or is it serving up REST-style writes and performs SQLite update statements behind the scenes? I guess if it’s the latter, it’s just a normal REST API for writes… but it still doesn’t secure read access at all, right? That is to say, you can’t put anything in the database you don’t want all users to be able to see?
- sekao 5y agoNo, it's not accepting database chunks; it's doing all the writes the typical way. And you are right that all data is completely public, unless you restrict access at the file host itself.