Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@couchdb.apache.org
Received-SPF: pass (nike.apache.org: domain of bchesneau@gmail.com designates
 209.85.160.52 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type;
        b=YytILGzj1dnTlGvdsqp2SJoYyBQZg7Yejp8/awGdMFMJrv+OK2JUcwL9ysGpoavJAN
         tWIQZM8JwE1iQqK+dtcgsq1ZlabhP95GdJ0wbL9YSjR3M56H2MPNGAeZidDYFElW6aAC
         QgHOAFMkyZFP9bKQ0oxs0SSYjmpANMul0xvQM=
MIME-Version: 1.0
In-Reply-To: <e282921e1003150915w1d6f5567g5f98a2dd6d157ef5@mail.gmail.com>
References: <b7cd8ed11003150852q5f0f77fcj94dbd0b100d23fc1@mail.gmail.com>
	 <e282921e1003150915w1d6f5567g5f98a2dd6d157ef5@mail.gmail.com>
Date: Mon, 15 Mar 2010 17:24:45 +0100
Message-ID: <b7cd8ed11003150924pd8cb3e0he7445b9af9bdbc95@mail.gmail.com>
Subject: Re: default vhost config option
From: Benoit Chesneau <bchesneau@gmail.com>
To: dev@couchdb.apache.org
Content-Type: text/plain; charset=ISO-8859-1

On Mon, Mar 15, 2010 at 5:15 PM, Chris Anderson <jchris@apache.org> wrote:
> On Mon, Mar 15, 2010 at 10:52 AM, Benoit Chesneau <bchesneau@gmail.com> wrote:
>> Hi all,
>>
>> Like discussed on irc, i would propose to add a default vhost option to couchdb:
>>
>> - it solves problem when someone connect to CouchDB whithout an host header
>> - it allows someone to not expose whole api of CouchDB using the rewriter.
>>
>
> As long as we are discussing security, we should think about this:
> It'd be nice to be able to "sandbox" _design documents to a given
> database (the one they are hosted in.) One way to do this is with a
> vhost rule that says mydb.mycouch.com may only make requests within
> /mydb/
>
> How to implement this is a bit tougher. Do we do path-based
> restrictions (after all rewrite rules have been applied)?  Do we
> restrict the rewriter's ability to use ../../.. constructs so that it
> must stay within it's own database?

This is needed if you want to have a _replicate handler at app level
though. But i don't see the need to restrict on this side, you look in
the wrong way. Imo we should restrict external calls not internals.

It could be done like i do on couchdbproxy (this version and the one
coming). couchdbproxy take all asks from this patch and use it as
prefix for all locations. Internally you can still rewrite, but what a
use will show is only locations prefixed by somepath/ .


>
> This stuff is crucial for security, as people will be replicating
> around random applications, and we don't want some spyware app to have
> access to the database which hosts your financial information.


there are other pbs for that and maybe I missed some commit. I think
about the possibility to read the users db or maybe i missed a commit.
Is there an handler like _security to create a user ?