Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (athena.apache.org: domain of snowebang@hotmail.com
 designates 65.54.190.164 as permitted sender)
Message-ID: <BAY002-W31146A293AA35369C9BC3A5E40@phx.gbl>
Content-Type: multipart/alternative;
	boundary="_f4da6bdf-769e-4e20-b28d-ae7be80dc908_"
From: TAE JIN KIM <snowebang@hotmail.com>
To: "user@couchdb.apache.org" <user@couchdb.apache.org>
Subject: RE: Curiosity how you use CouchDB in your web env.
Date: Thu, 7 Mar 2013 04:11:09 +0900
Importance: Normal
In-Reply-To: 
 <CABvT1DHRF1=OuRnrCiSxJuNS08UPWD9mVAqW0PGCh1wYMNa44g@mail.gmail.com>
References: 
 <BAY002-W22254A2D930478393314CB2A5E40@phx.gbl>,<CACrj35FAbVXPbiNY0nWXDhmoY5gH-Br+9oYrwoFEhx-v=HXs6w@mail.gmail.com>,<FB4ABA34-6B47-4033-804E-6025E3BE14C9@me.com>,<CABvT1DHxApXndvU8gEGnZ_y=bOjg1+5X_4g7=JrrNHN9OXQz6A@mail.gmail.com>,<CACrj35GDeBOoT-758XMF5_fx1cYVXd=oi--V7AYPCqqSV0FUrg@mail.gmail.com>,<BA097FD0-82D0-4A96-BE65-D78750A858AB@utt.fr>,<CABvT1DEFdDcPEx8y214gWwKKUQb=s4mruepDueCs3_nmNAR8ZA@mail.gmail.com>,<CACrj35FTrcggUN_auAqT0yoRa77hnYMtK-DcKjP23KRCJ041hA@mail.gmail.com>,<CABvT1DHRF1=OuRnrCiSxJuNS08UPWD9mVAqW0PGCh1wYMNa44g@mail.gmail.com>
MIME-Version: 1.0

--_f4da6bdf-769e-4e20-b28d-ae7be80dc908_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Let's suppose that you deployed your html to http://127.0.0.1:5984/testdb/_=
design/frontend/Index.htm served by your CouchDB directly.
How do you set up in a way that anonymous users are only able to access _de=
sign/front-end=2C but nothing else like futon management pages(_utils)
Looks like you may be able to set up an account=2C but still anonymous user=
s still are able to read futon management page(_utils) for all of database =
and documents...
=20
Thanks=2C

> Date: Wed=2C 6 Mar 2013 12:42:28 -0600
> Subject: Re: Curiosity how you use CouchDB in your web env.
> From: rnewson@apache.org
> To: user@couchdb.apache.org
>=20
> Don't grant users access to databases you don't want them to read. :)
>=20
> http://wiki.apache.org/couchdb/Security_Features_Overview#Authorization
>=20
> B.
>=20
> On 6 March 2013 12:33=2C Mark Hahn <mark@hahnca.com> wrote:
> > Anyone logged in can read any document in the DB.  I have to check each
> > user and what they are trying to do to block illegal actions.
> >
> >
> > On Wed=2C Mar 6=2C 2013 at 9:51 AM=2C Robert Newson <rnewson@apache.org=
> wrote:
> >
> >> "How does everyone solve the security issue?"
> >>
> >> What security problem? Only administrators can modify design documents=
.
> >>
> >> B.
> >>
> >> On 6 March 2013 11:38=2C Aur=E9lien B=E9nel <aurelien.benel@utt.fr> wr=
ote:
> >> > Hi=2C
> >> >
> >> >> just out of curiosity=2C would like to hear how CouchDB is being us=
ed in
> >> your web environment....
> >> >
> >> > We have two main setups:
> >> > - CouchApps=2C
> >> > - REST APIs used by heavy clients (Java or Firefox extensions) and
> >> attached Web applications.
> >> >
> >> >> How does everyone solve the security issue?
> >> >
> >> > We always use CouchDB behind a reverse proxy to add LDAP authenticat=
ion
> >> and authorization when needed.
> >> >
> >> >
> >> > Regards=2C
> >> >
> >> > Aur=E9lien
> >>
 		 	   		  =

--_f4da6bdf-769e-4e20-b28d-ae7be80dc908_--