6 ms·

That is really cool, and I'll definitely be using it! Since I found out about sqlite-utils being able to trivially put JSON into a sqlite database without need

That is really cool, and I'll definitely be using it! Since I found out about sqlite-utils being able to trivially put JSON into a sqlite database without needing to stop and write out a whole schema, I've used it a few times. In the process I did think to myself, "why isn't there anything that just lets me dump JSON into an endpoint?". I didn't get around to doing it, and I actually thought maybe it wasn't such a great idea if it hadn't been done yet, because it seemed so obvious. Glad to see I'm not crazy :) The flexibility and ease of getting different output formats (including charts!) from Datasette is something I hadn't considered, and it looks amazing!

simonw 4y ago
Something I've been contemplating is if I should add a mode that lets you make unauthenticated write API calls from localhost - like Redis and MongoDB do. It would need to be an explicit opt-in thing because I've seen what happens if you release software that is open by default, and it's not good!
- fbdab103 4y ago
  I like the idea of having some way to do unauthenticated calls, but would it be possible to layer on some additional granularity or would that be asking too much when the security infrastructure already exists? That is, I might want to be able to append data without any ceremony (logs?), but schema changes or data mutation would require credentials.
  - simonw 4y ago
    The big feature in the next alpha will be the ability to create tokens that have a subset of permissions - eg can only write to specific tables: https://github.com/simonw/datasette/issues/1855 https://github.com/simonw/datasette/issues/1855 But maybe a mechanism for easily specifying that for anonymous localhost users would be useful too?
- pedrovhb 4y ago
  Or a bit more generically, having a configurable allowlist of hosts, so I can make my ESP32 just a dumb "sensors on a microcontroller" thing pushing data to a RPi on my local home network, which has static IPs provided to certain devices via DHCP. Having to add an auth header isn't a great deal of work, but it'd be handy to be able to try things out quickly. IMO the great thing about all this is how frictionless it is.
  - simonw 4y ago
    I like that: I can have a thing where you can provide "localhost" but can also provide other host names and IPs too.
    - vorpalhex 4y ago
      That approach also makes things more docker friendly.
    - tlarkworthy 4y ago
      Unfortunately the host header is spoofable
      - simonw 4y ago
        You mean the HTTP host header? Yeah that's a good call: I need to do these checks only based on IP. I could allow users to enter host names which I would resolve to the IP before checking though, which matches how networking is used in things like Kubernetes.

simonw 4y ago

Something I've been contemplating is if I should add a mode that lets you make unauthenticated write API calls from localhost - like Redis and MongoDB do. It would need to be an explicit opt-in thing because I've seen what happens if you release software that is open by default, and it's not good!

fbdab103 4y ago
I like the idea of having some way to do unauthenticated calls, but would it be possible to layer on some additional granularity or would that be asking too much when the security infrastructure already exists? That is, I might want to be able to append data without any ceremony (logs?), but schema changes or data mutation would require credentials.
- simonw 4y ago
  The big feature in the next alpha will be the ability to create tokens that have a subset of permissions - eg can only write to specific tables: https://github.com/simonw/datasette/issues/1855 https://github.com/simonw/datasette/issues/1855 But maybe a mechanism for easily specifying that for anonymous localhost users would be useful too?
pedrovhb 4y ago
Or a bit more generically, having a configurable allowlist of hosts, so I can make my ESP32 just a dumb "sensors on a microcontroller" thing pushing data to a RPi on my local home network, which has static IPs provided to certain devices via DHCP. Having to add an auth header isn't a great deal of work, but it'd be handy to be able to try things out quickly. IMO the great thing about all this is how frictionless it is.
- simonw 4y ago
  I like that: I can have a thing where you can provide "localhost" but can also provide other host names and IPs too.
  - vorpalhex 4y ago
    That approach also makes things more docker friendly.
  - tlarkworthy 4y ago
    Unfortunately the host header is spoofable
    - simonw 4y ago
      You mean the HTTP host header? Yeah that's a good call: I need to do these checks only based on IP. I could allow users to enter host names which I would resolve to the IP before checking though, which matches how networking is used in things like Kubernetes.