couchdb-user mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Jason Smith <>
Subject Re: to CouchApp or not to CouchApp
Date Tue, 16 Aug 2011 00:30:43 GMT
On Thu, Aug 4, 2011 at 4:22 AM, Randall Leeds <> wrote:
>> To add to this, when you create a vhost configuration on iriscouch, I
>> believe iriscouch actually sees that configuration change and changes
>> a downstream proxy. Submitting a request without a Host header will
>> make it so that iriscouch does not know where to route your request
>> and it returns an error.
>> Now there's still the problem that if someone knows your
>> address they can bypass that. It would be a
>> valid question for iriscouch support to ask whether that can be locked
>> down by requiring a valid user, at which point you could use vhosts
>> pretty securely.

I'm still not convinced those jokers at Iris Couch know what they are doing.

> Here I mean to say that require_valid_user=true is great for locking
> down your couch, but one might want to only lock down the raw couch
> interface and not require a valid user when going through a vhost, so
> you could still have a logged out public landing page for your
> couchapp.

Vhosts and rewrites are not pertinent to a security assessment of
CouchDB. Simplify. Simplify. Use the Couch tools to establish the
security you need. Then add vhosts and rewrites as needed by your
application. Subsequent vhost/rewrite changes will not threaten the
security situation.

Things to think about regarding CouchDB security:

* Authentication: basic, cookie, BrowserID, http vs. https
* Users
* Roles
* Database security objects
* validate_doc_update() functions in each database

I am pretty sure that is exhaustive. The best starting point to learn
about CouchDB security is the "Definitive Guide" book.

The best tool (to my knowledge) to understand what's going on is Audit
CouchDB (basically nessus for CouchDB).


    npm -g install audit_couchdb
    audit_couchdb https://admin:secret@mycouch:5984

Run it and do what it says. Or check out its source code for a
detailed look at CouchDB security.

Currently Audit CouchDB only runs in NodeJS, however the major
requirement is the Node "request" module, which I recently ported to

Thus porting it to the browser should be easy. I haven't done that yet
since, for better or worse, I find myself surrounded by node binaries

Iris Couch

View raw message