CODEWITHSUNDEEP
javascriptsecuritygraph-databasesarangodb
Márius Rak
Márius Rak

Reputation: 1472

Secure db queries in single page web app

I'm creating single page web app with ArangoDB for storage. Arango provides awesome ways for accessing and manipulating data. One of them is classic JS API. It would be easy to write straightforward DB queries in client side JS which would be direct queries for DB. So no server application in middle.

Of course, this is really unsecure pattern. So I should write some sort of REST-full API service that queries data from server via URL and later server queries the DB. But this is really inconvenient, since I'd need to write two or three times more code (first query for my server, second query for DB, and perhaps some translator between the two queries). Also, I think that API calls for my server would look almost same as API calls for DB.

I don't want to go for full abstraction since the app should be complex and there would be a lot of types of API request, which would only bring bugs and eat more time.

So what is the best way for requesting data in client app from DB in terms of, firstly, security and, secondly, ease of coding?

Upvotes: -1

Views: 486

Answers (2)

Márius Rak
Márius Rak

Reputation: 1472

I found a GraphQL with Relay by Facebook which solves this problem best.

Upvotes: 0

gusto2
gusto2

Reputation: 12085

I'd really suggest to write REST API calls (or generally URL calls) to access your data. Anything what run on the client side or any traffic from the client can be accessed and manipulated. That comes with authentication and SQL calls themselves. What you want to secure? DB client authentication? If you encrypt it, you need to decrypt it on the client side. SQL calls - if you build and transmit them, the client could manipulate them to get / update ANY data with ANY values. Really no easy way around.. So - to be safe - stick to the patterns here..

Upvotes: 1

Related Questions