couchdb-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Benoit Chesneau (Commented) (JIRA)" <>
Subject [jira] [Commented] (COUCHDB-1287) Inbox Database ("write-only" mode)
Date Mon, 21 Nov 2011 04:05:51 GMT


Benoit Chesneau commented on COUCHDB-1287:

Ok i'm starting annoyed. To be clear I'm -1 about an implementation based on paths**. While
authentication is done at HTTP level, authorization shouldn't. It should be resource or feature
based. Basing auth on paths and methods open the door to a lot of unexpected problems imo.
So I proposed an alternative patch to handle a dropbox features where goal is simple :

- allows anyone to post a doc.
- only db admins can read or query these docs.
- a dropbox db looks empty for anyone except for admins.
- be handled at the core level (couch_db or core functions) when possible to make it easier
for the dev to handle these topics.

Which is sensibly the same you described. I simplified maybe a little in attempt to make it
easier to use and implement. 

re the *alternative* patch I posted .  _changes is  indeed displaying the docids, however
this isn't true when you say it's insecure or dangerous.  it doesn't display a doc content,
it actually return null (see following tests...) and _all_docs return a 401 error . It is
incomplete: _changes features like _all_docs should test if the user is an admin first. New
patch is coming fixing that. 

/testdb return numbers of docs. Not sure why it's a breach here but I can understand the logic.
I will again provide a patch fixing that.


    $ curl -XPUT http://admin:test@localhost:5984/testdb

    $ curl -XPUT http://admin:test@localhost:5984/testdb/_security -d'{"dropbox": true}'

    $ curl -XPOST http://localhost:5984/testdb -d'{"k": "v"}' -H'Content-Type: application/json'

    $ curl -XGET http://localhost:5984/testdb/9cee7d60bc1a4e9dbc7584b3f6000f61
    {"error":"unauthorized","reason":"You are not a db or server admin."}

    $ curl -XGET http://test:test@localhost:5984/testdb/9cee7d60bc1a4e9dbc7584b3f6000f61
    {"error":"unauthorized","reason":"You are not a db or server admin."}

    $ curl -XGET http://localhost:5984/testdb/_all_docs
    {"error":"unauthorized","reason":"You are not a db or server admin."}

   $ curl -XGET http://localhost:5984/testdb/_all_docs -I
HTTP/1.1 401 Unauthorized
Server: CouchDB/1.3.0a-b4295e6-git (Erlang OTP/R14B04)
Date: Mon, 21 Nov 2011 04:03:25 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 70

    $ curl -XGET http://admin:test@localhost:5984/testdb/_all_docs

    $ curl -XGET http://localhost:5984/testdb/_changes

    Benoits-MacBook-Air:~ benoitc$ curl -XGET http://localhost:5984/testdb/_changes?include_docs=true

    $ curl -XGET http://admin:test@localhost:5984/testdb/_changes?include_docs=true

> Inbox Database ("write-only" mode)
> ----------------------------------
>                 Key: COUCHDB-1287
>                 URL:
>             Project: CouchDB
>          Issue Type: New Feature
>          Components: HTTP Interface
>    Affects Versions: 1.2
>            Reporter: Jason Smith
>            Priority: Minor
>         Attachments: 0001-handle-dropbox-db.-Add-dropbox-true-to-security-obje.patch,
A_0001-Refactor-reader_acl-test-functions-into-a-loop.patch, A_0002-Refactor-the-actual-read-check-out-of-the-member-che.patch,
A_0003-Allow-non-member-writes-if-_security.members.allow_a.patch, B_0001-Refactor-reader_acl-test-functions-into-a-loop.patch,
B_0002-Refactor-the-actual-read-check-out-of-the-member-che.patch, B_0003-Allow-non-member-updates-if-_security.members.allow_.patch
> Currently, we can only grant combined read+write access in the _security object "members"
section. A user can either do both or neither. This prevents a very common requirement for
couch apps: sending private information from less-privileged users to more-privileged users.
> There is no (reasonable) way to make an "inbox" where anybody may create a doc for me,
but only I may read it. An inbox database allows user-to-user, or user-to-admin private messages.
(Not only chat messages, but asynchronous notifications--with a per-user inbox, perhaps even
service requests and responses.)
> There is no reason _security.members (formerly .readers) should control write access.
validate_doc_update() functions do this better.
> I propose a boolean flag, _security.members.allow_anonymous_writes. If it is true, then
CouchDB will allow document updates from non-members, giving validate_doc_update() the final
word on accepting or rejecting the update.
> Requirements:
> 1. Everything about _security stays the same (backward-compatible)
> 2. If members.allow_anonymous_writes === true, then most PUT and POSTs may proceed
> 3. All updates are still subject to approval by all validate_doc_update functions, same
as before.
> These are the known changes to the security model. I consider these all to be either
very unlikely in practice, or worth the trade-off.
> * If you write to an inbox DB, you know, for a time, a subset of its documents (but that's
the point)
> * An _update function could reveal a document to the user, with or without changing it.
However, an admin must install such a misguided update function.
> * You can launch timing attacks to learn information about validate_doc_update
>   * You might discover whether doc IDs exist in the DB or not
>   * You might discover a well-known open source validation function. You can look for
bugs in its source code.
> * Zero or more things which Jason can't think of

This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:!default.jspa
For more information on JIRA, see:


View raw message