You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@couchdb.apache.org by jumbo jim <ju...@gmail.com> on 2015/07/28 02:39:23 UTC
Hide all _all_docs and _changes
Hi,
It is possible to disable the "_all_docs" feature by editing the local.ini
and entering the following -
[httpd_db_handlers]
_all_docs =
However, I then realised that a user could basically get a full listing of
all documents by requesting _changes. So, I now use -
[httpd_db_handlers]
_all_docs =
_changes =
Do I need to close anything else off if I want to prevent a particular user
from seeing a list of all documents?
Also - is it possible to do disable _all_docs/ and _changes for only
specific databases? I would still like the admin to use _all_docs/ and
_changes
Thanks
Re: Hide all _all_docs and _changes
Posted by Mike Marino <mm...@gmail.com>.
Hi Jim,
I don't know of a way to do this using simply couchdb. Probably the best
(standard?) way to ensure that only the pieces of the API are available
which you want is to use a reverse proxy, e.g. nginx. Indeed, it is much
easier and safer to explicitly turn on the things you want, then to try to
turn off everything you don't need.
Cheers,
Mike
On Tue, Jul 28, 2015 at 2:39 AM, jumbo jim <ju...@gmail.com> wrote:
> Hi,
>
> It is possible to disable the "_all_docs" feature by editing the local.ini
> and entering the following -
>
> [httpd_db_handlers]
> _all_docs =
>
> However, I then realised that a user could basically get a full listing of
> all documents by requesting _changes. So, I now use -
>
> [httpd_db_handlers]
> _all_docs =
> _changes =
>
>
> Do I need to close anything else off if I want to prevent a particular user
> from seeing a list of all documents?
>
>
>
> Also - is it possible to do disable _all_docs/ and _changes for only
> specific databases? I would still like the admin to use _all_docs/ and
> _changes
>
> Thanks
>
Re: Hide all _all_docs and _changes
Posted by jumbo jim <ju...@gmail.com>.
To clarify, I am using middleware and am not presenting the api or futon
directly to end user.
When it comes to security, I tend to turn everything off by default, and
then only permitting what I want to trickle through. The middleware uses a
non-admin account. However, this middleware has no business in listing all
documents.
This link has suggested using a proxy as have others..
https://stackoverflow.com/questions/1923352/how-to-secure-couchdb
It mentions to "rewrite /_all_docs and /*/_design/* to a 404 page". I would
further conclude that /*/_changes needs to be included.
> This seems like a brittle approach, what are you trying to accomplish?
Agreed. As shown above, there may be other endpoints I am not aware of.
I would like to explicitly rewrite URLs, rather than implicitly. Consider
the following -
http://x.x.x.x:5984/db/_all_docs (deny)
http://x.x.x.x:5984/db/d3b07384d113edec49eaa6238ad5ff00 (permit any doc for
reading)
Perhaps I could rewrite /*/_* to 404.. and then permit only specific views
should I need them ? ( /*/_view/xxxx )
Thanks
On Tue, Jul 28, 2015 at 5:54 PM, Jan Lehnardt <ja...@apache.org> wrote:
>
> > On 28 Jul 2015, at 02:39, jumbo jim <ju...@gmail.com> wrote:
> >
> > Hi,
> >
> > It is possible to disable the "_all_docs" feature by editing the
> local.ini
> > and entering the following -
> >
> > [httpd_db_handlers]
> > _all_docs =
> >
> > However, I then realised that a user could basically get a full listing
> of
> > all documents by requesting _changes. So, I now use -
> >
> > [httpd_db_handlers]
> > _all_docs =
> > _changes =
> >
> >
> > Do I need to close anything else off if I want to prevent a particular
> user
> > from seeing a list of all documents?
>
> This seems like a brittle approach, what are you trying to accomplish?
>
> > Also - is it possible to do disable _all_docs/ and _changes for only
> > specific databases? I would still like the admin to use _all_docs/ and
> > _changes
>
> That’s not possible.
>
> Best
> Jan
> --
>
>
> >
> > Thanks
>
> --
> Professional Support for Apache CouchDB:
> http://www.neighbourhood.ie/couchdb-support/
>
>
Re: Hide all _all_docs and _changes
Posted by Jan Lehnardt <ja...@apache.org>.
> On 28 Jul 2015, at 02:39, jumbo jim <ju...@gmail.com> wrote:
>
> Hi,
>
> It is possible to disable the "_all_docs" feature by editing the local.ini
> and entering the following -
>
> [httpd_db_handlers]
> _all_docs =
>
> However, I then realised that a user could basically get a full listing of
> all documents by requesting _changes. So, I now use -
>
> [httpd_db_handlers]
> _all_docs =
> _changes =
>
>
> Do I need to close anything else off if I want to prevent a particular user
> from seeing a list of all documents?
This seems like a brittle approach, what are you trying to accomplish?
> Also - is it possible to do disable _all_docs/ and _changes for only
> specific databases? I would still like the admin to use _all_docs/ and
> _changes
That’s not possible.
Best
Jan
--
>
> Thanks
--
Professional Support for Apache CouchDB:
http://www.neighbourhood.ie/couchdb-support/
Re: Hide all _all_docs and _changes
Posted by Giovanni Lenzi <g....@smileupps.com>.
Hi jim,
you could use together the couchdb vhosts feature and _rewrite of design
documents, and allow requests with a specific host header only, by using a
proxy(like haproxy) in front of couchdb as a kind of firewall.
This will allow then to use an empty rewrites.json file to completely
forbid access, while you can add more rules to increasingly unlock access
to your app features/data.
This approach is used by smileupps apps and chatty tutorial
https://www.smileupps.com/couchapp-tutorial-chatty
https://www.smileupps.com/couchapp-tutorial-chatty-couchapp-design
Hope this helps
Hi,
It is possible to disable the "_all_docs" feature by editing the local.ini
and entering the following -
[httpd_db_handlers]
_all_docs =
However, I then realised that a user could basically get a full listing of
all documents by requesting _changes. So, I now use -
[httpd_db_handlers]
_all_docs =
_changes =
Do I need to close anything else off if I want to prevent a particular user
from seeing a list of all documents?
Also - is it possible to do disable _all_docs/ and _changes for only
specific databases? I would still like the admin to use _all_docs/ and
_changes
Thanks