Clash Royale CLAN TAG

How to implement a client to server connection that is secure and syncs

I’m struggling to understand how the pouchDB interactions should be implemented. Say I want an offline-first app with syncing and auth, would I need to implement a middleman such as a node server to ensure my credentials to my main server are protected as having a PouchDB on the client with new PouchDB(‘name’, ‘https://username:password@server/dbname’) my creds to my main database are exposed. Would it be better to connect to a node server and that decide wether or not to allow access?

How would this be done? Can I handle a direct connection to the server with auth and it be secure? Or is a middle man needed to ensure security.

If a middle man is needed will you need to implement a sort of api i.e

//client
const db = new Pouch('days')
db.sync(remote)

//server
app.get('/db/days', (res, req) => // do some pouch stuff for each db)


https://github.com/pouchdb-community/pouchdb-authentication

1 Answer
1

Somewhat simplified, if your application is backed by an application 'master' database and it runs using a single set of credentials, you need a middle layer: you will then need to multiplex all users' data into a single database.

Applications backed by CouchDB/Cloudant often instead use the 'database-per-user' pattern, meaning that each application user have their own database, and their own credentials, meaning that a lot of things become simpler, conceptually, and a middle layer might not be required.

Note that the 'database-per-user' pattern needs some thought to scale well if you intend to cater for millions of users.

On Cloudant you can also use API keys to define access.

If you want the simplicity of the db-per-user pattern without (some of) the drawbacks, you may be able to draw some inspiration from Cloudant Envoy (https://github.com/cloudant-labs/envoy) -- a thin proxy that multiplexes users' data into a single db, whilst still presenting the db-per-user API surface outwards. Disclaimer: I'm one of the authors of Envoy.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.