Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (nike.apache.org: domain of manuel.schoelling@gmx.de
 designates 213.165.64.20 as permitted sender)
Subject: Application security model
From: Manuel =?ISO-8859-1?Q?Sch=F6lling?= <manuel.schoelling@gmx.de>
To: user@couchdb.apache.org
Content-Type: text/plain; charset="UTF-8"
Date: Sat, 19 Dec 2009 13:47:48 +0100
Message-ID: <1261226868.2415.15.camel@roadrunner>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit

Hi there,

I'm just starting off with couch db.

There is something I'm wondering about: how should I implement the
authorization to access a document.

>>From an outsider's view, one would use HTTP's authorization method when
using any PUT/GET/POST/DELETE requests.
But (as I understand it correctly) this mechanism is just available for
couch db administrator accounts.

So how should I implement a web application security layer?
Is there any panacea?

On could add a security field that includes ACL data to each document.
Then any update validation, view and list must check this data against a
user id and password that must be included in the REST request.

Or should you really create one couch db admin account for each user?
(I'm referring to a web application end-user here)


Cheers,

Manuel