Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: neutral (nike.apache.org: local policy)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Apple Message framework v1081)
Subject: Re: granting read-only access to anonymous users
From: J Chris Anderson <jchris@couch.io>
In-Reply-To: <1279835274.2979.57.camel@west>
Date: Thu, 22 Jul 2010 14:16:57 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <C661EE24-4D14-438F-ADC2-A5DC818A3D88@gmail.com>
References: <1279835274.2979.57.camel@west>
To: user@couchdb.apache.org


On Jul 22, 2010, at 2:47 PM, Catherine Jones wrote:

> I have a couch database (with an admin and and an admin password
> defined) that's sitting behind an nginx proxy. The ngin proxy routes
> traffic between http://127.0.0.1:5984 on my VPS and the public address
> of http://my_domain_name/subdirectory_name. I want anonymous visitors =
to
> my website to be able to read from the database but not write to it.=20=

>=20
> While I can include validation functions in my design documents, this
> doesn't, as far as I can tell, prevent an anonymous person from =
sending
> a request like:
>=20
> curl -X PUT http://my_domain_name/subdirectory_name/my_database_name/
>                   "some_new_doc_id" -d @some_json_file
>=20
> and thus writing a new document to the database. I can use an obscure
> name for the database, of course, but isn't there some better way? Am =
I
> missing something here?  Thanks...
>=20

You can reject all writes in a validation function, so this is =
definitely possible.

What you probably want to do is=20

function(newDoc, oldDoc, userCtx) {
 if (userCtx.name !=3D "Catherine"} throw({forbidden:"only Catherine can =
write");
}

> Catherine
>=20
>=20
>=20