3 ms·
"If the mechanisms to restrict access were in place the CouchDB backend could be exposed to the browser directly, removing the server side application code as a
by maukdaddy 17y ago
"If the mechanisms to restrict access were in place the CouchDB backend could be exposed to the browser directly, removing the server side application code as a bottleneck."
Never, EVER expose a database to a client! Doesn't matter what types of controls you think you have, you must ALWAYS have some business logic in place to protect the data.
- nothingmuch 17y agoIf the business logic is implemented in couchdb or implemented in serverside code, it's still business logic protecting the data. It could be just as flawed, or even worse (e.g. sql injection allows malicious users to run database operations with no restrictions at all. If there were db level restrictions they could only destroy their own data). This ALWAYS NEVER EVER type of mentality demonstrates exactly why CouchDB is simultaneously overhyped and condemned.