Mailing-List: contact user-help@cassandra.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@cassandra.apache.org
Received-SPF: pass (nike.apache.org: domain of martygreenia@gmail.com
 designates 72.14.220.156 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type;
        b=jjTkPF5FcLxeZpIXKRA+zz5oMEu++eB04LPZwdw/V1ENTRI51FvYg5WdtLaze2QVce
         ihKAWm9yk/6d0cY8WBqTbe1r9Q93ySca2Y09i63hMX58P7gl4/LMVjPmBT5FElYbiRgJ
         EODMomVy9RZNuhHy8UDCF5JVIbiSN2nPCZelk=
MIME-Version: 1.0
In-Reply-To: <AANLkTim5ebzRLASuBDaxe2e6LczDTIfGkV5o5jFoL33R@mail.gmail.com>
References: 
 <5A4D71ACC2708E4BB1BD7B6F87E51C6B07FA3B27@sccorpmail01.mygazoo.com>
	<AANLkTinHPluEGebYQGhBGOmsV28EYExZjxyFenqTsjwY@mail.gmail.com>
	<AANLkTinD6sJkN01Owb0sMG_GnuWAKeE1eLv9QXAh-dDK@mail.gmail.com>
	<AANLkTim5ebzRLASuBDaxe2e6LczDTIfGkV5o5jFoL33R@mail.gmail.com>
Date: Mon, 28 Jun 2010 14:20:36 -0700
Message-ID: <AANLkTikfQJLUdEC42F92KRXgRpe1lQZ6xN8rvns349sU@mail.gmail.com>
Subject: Re: Cassandra and Thrift on the Server Side
From: Marty Greenia <martygreenia@gmail.com>
To: user@cassandra.apache.org
Content-Type: multipart/alternative; boundary=001485f85dcc16c250048a1db192

--001485f85dcc16c250048a1db192
Content-Type: text/plain; charset=ISO-8859-1

I agree, it would probably make more sense to just use a conventional http
server to interface with the browser clients on the front-end to act as a
pass-through to cassandra on the back-end. No sense re-implementing all that
functionality.

Still, to Clint's point, everyone knows how to make an HTTP request. If you
want a cassandra client running on, let's say, an iPhone for some reason, a
REST API is going to be a lot more straight forward to implement.


On Mon, Jun 28, 2010 at 1:53 PM, Paul Prescod <paul@prescod.net> wrote:

> On Mon, Jun 28, 2010 at 1:45 PM, Marty Greenia <martygreenia@gmail.com>
> wrote:
> > Would it ever be useful to someday have browser clients access cassandra
> > servers directly? I imagine that would be the most compelling scenario to
> > have REST API for.
>
> This is an interesting idea, but introduces quite a few security
> complexities. Which keys will a particular browser client be allowed
> to overwrite? What prevents an end-user from deleting your database
> through AJAX calls?
>
> I think you'd need some form of ACL and access token system. That's a
> lot of complexity.
>
>  Paul Prescod
>

--001485f85dcc16c250048a1db192
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

I agree, it would probably make more sense to just use a conventional http =
server to interface with the browser clients on the front-end to act as a p=
ass-through to cassandra on the back-end. No sense re-implementing all that=
 functionality.<br>
<br>Still, to Clint&#39;s point, everyone knows how to make an HTTP request=
. If you want a cassandra client running on, let&#39;s say, an iPhone for s=
ome reason, a REST API is going to be a lot more straight forward to implem=
ent.<br>
<br><br><div class=3D"gmail_quote">On Mon, Jun 28, 2010 at 1:53 PM, Paul Pr=
escod <span dir=3D"ltr">&lt;<a href=3D"mailto:paul@prescod.net">paul@presco=
d.net</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"b=
order-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; paddin=
g-left: 1ex;">
<div class=3D"im">On Mon, Jun 28, 2010 at 1:45 PM, Marty Greenia &lt;<a hre=
f=3D"mailto:martygreenia@gmail.com">martygreenia@gmail.com</a>&gt; wrote:<b=
r>
&gt; Would it ever be useful to someday have browser clients access cassand=
ra<br>
&gt; servers directly? I imagine that would be the most compelling scenario=
 to<br>
&gt; have REST API for.<br>
<br>
</div>This is an interesting idea, but introduces quite a few security<br>
complexities. Which keys will a particular browser client be allowed<br>
to overwrite? What prevents an end-user from deleting your database<br>
through AJAX calls?<br>
<br>
I think you&#39;d need some form of ACL and access token system. That&#39;s=
 a<br>
lot of complexity.<br>
<font color=3D"#888888"><br>
=A0Paul Prescod<br>
</font></blockquote></div><br>

--001485f85dcc16c250048a1db192--