Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (nike.apache.org: local policy)
Date: Sat, 9 Feb 2013 17:10:51 +0200
From: svilen <az@svilendobrev.com>
To: user@couchdb.apache.org
Subject: Re: replication on touchdb and authentication
Message-ID: <20130209171051.4b9d9c93@svilendobrev.com>
In-Reply-To: <CEA74E49-807C-4859-9222-7CEA199C87FB@couchbase.com>
References: <20130208121706.5320cd2e@svilendobrev.com>
	<CEA74E49-807C-4859-9222-7CEA199C87FB@couchbase.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

> > i'm trying to replicate a per-user database to/from touchdb on
> > mobile device
> What mobile platform?
both android and ios. maybe one day win8..

> > so i wanted to do cookie-based /_session authentication, but i
> > don't see where to put the cookie (eventually obtained by manualy
> > POSTing on server/_session).=20
>=20
> This isn=E2=80=99t any different, from the app=E2=80=99s perspective; you=
 still have
> to provide a username and password somehow, they=E2=80=99re just sent to =
the
> server slightly differently.
well i know i can store the passwords, be it secure or not.. but i
don't want to. i want to store cookies instead. Like a browser does.
And start any replications by authenticating with those.
can i do that?


> Recent builds of TouchDB (now aka Couchbase Lite) include support for
> the new BrowserID protocol, which is a single-sign-on system similar
> to OpenID that lets users log in with any working email address. Of
> course the server needs to support it too; IrisCouch=E2=80=99s servers
> already do, and they have a plugin for CouchDB on GitHub that you can
> add if you run your own server.
>=20
> There=E2=80=99s also OAuth, which TouchDB also supports. OAuth is an ugly
> mess IMHO and I would avoid it unless you=E2=80=99re really eager to prov=
ide
> logins via Facebook accounts.
All those single-sign-on things are good for something and not that good
for other.. maybe at later stage.

if i can use _session cookies, then it will only depend on server-side
login-wrapping-API for translating all the auth methods into couchdb
cookies. i want to take the authentication complexity away of
couchdb.

> BTW, the mobile-couchbase list is the best place to discuss
> TouchDB/Couchbase Lite specific issues:
> https://groups.google.com/forum/?fromgroups#!forum/mobile-couchbase
okay next time i'll ask there=20

svilen