5 ms·

I can't see any reason why application logic would be any less robust on the client vs the server. With regards to authorization there's examples from the nosql

by ollysb 12y ago

I can't see any reason why application logic would be any less robust on the client vs the server. With regards to authorization there's examples from the nosql world, e.g. couchbase's sync gateway[1]. You could argue that you might as well use rails instead but a proxy that's focused on just authorization can be far more performant. [1] http://docs.couchbase.com/sync-gateway http://docs.couchbase.com/sync-gateway

andrewstuart2 12y ago
The reason it's less robust is that I could use curl to send a DELETE request for records I shouldn't be able to delete. Or POST some data saying my order is paid in full. Business logic that matters at all has to be validated by some authority. The client is never good enough.
- ollysb 12y ago
  That's the purpose of the sync-gateway(in couchdb's case), it handles authorisation of actions against couchdb.
  - andrewstuart2 12y ago
    Just because I'm authorized to create a record doesn't mean it's a valid record. Take my new order example. If all business rules, including payment authorization and payment record keeping, are handled client side, I can easily say that a valid payment has been made when it hasn't.
    - ollysb 12y ago
      I can see how there's a class of applications that would need the level of verification you're talking about(payment authorization being a good example). Many apps don't need that level of verification though, an app like trello for instance only needs to authorize actions against an entire resource, not values within a resource.
      - mercurial 12y ago
        On the other hand, if your app has no business rules, one would assume that your server-side application is going to be extremely thin.
- troyk 12y ago
  you can do the same with psql, rails bin commands, php, or anything else that can talk to the db
  - deleted 12y ago
    [deleted]
  - mercurial 12y ago
    Which is precisely why your DB server is behind your firewall.

by ollysb 12y ago

andrewstuart2 12y ago

The reason it's less robust is that I could use curl to send a DELETE request for records I shouldn't be able to delete. Or POST some data saying my order is paid in full. Business logic that matters at all has to be validated by some authority. The client is never good enough.

ollysb 12y ago
That's the purpose of the sync-gateway(in couchdb's case), it handles authorisation of actions against couchdb.
- andrewstuart2 12y ago
  Just because I'm authorized to create a record doesn't mean it's a valid record. Take my new order example. If all business rules, including payment authorization and payment record keeping, are handled client side, I can easily say that a valid payment has been made when it hasn't.
  - ollysb 12y ago
    I can see how there's a class of applications that would need the level of verification you're talking about(payment authorization being a good example). Many apps don't need that level of verification though, an app like trello for instance only needs to authorize actions against an entire resource, not values within a resource.
    - mercurial 12y ago
      On the other hand, if your app has no business rules, one would assume that your server-side application is going to be extremely thin.
troyk 12y ago
you can do the same with psql, rails bin commands, php, or anything else that can talk to the db
- deleted 12y ago
  [deleted]
- mercurial 12y ago
  Which is precisely why your DB server is behind your firewall.