Using CouchApps in Couch 3.2.2

[Alan Malta <al...@gmail.com>]

Hi everyone,

I tried to update CouchDB from version 3.1.2 to 3.2.2 today, and I noticed
that my couchapp isn't working properly.
I understand that this is actually the critical vulnerability issue that
got fixed in CouchDB 3.2.x, and apparently CouchApps no longer work in the
latest CouchDB series [1].

It isn't clear to me if there is any configuration that could be set to
keep CouchApps functional (same behavior of 3.1.2?) in 3.2.2? Or is moving
away from CouchApps the only option here?

Thank you in advance for any insight you can provide.
Best,
Alan.

[1]
https://blog.cloudant.com/2021/10/20/CouchApps-no-longer-work.html

Re: Using CouchApps in Couch 3.2.2

[Alan Malta <al...@gmail.com>]

Hi ermouth,

I am afraid I didn't express myself properly in my previous email. CouchDB
itself is fully functional with the upgrade,
however CouchApps applications were not.

Anyhow, you nailed it and indeed with the local.ini configuration you
suggested, I can now execute the javascript app.
For the record, this is what had to be added to the configuration file:
"""
[csp]
utils_enable = false
attachments_enable = false
showlist_enable = false
"""

Thank you very much!
Best,
Alan.

On Fri, Jul 22, 2022 at 11:31 PM ermouth <er...@gmail.com> wrote:

> Hi,
>
> CouchDB hosted apps generally work ok in 3.2.2, however small config
> tune ups required after upgrade from 3.1.
>
> First you need to carefully copy 3.1 config, considering [couch_httpd_auth]
> members moved to [chttpd_auth] since 3.2. Read more here
> https://docs.couchdb.org/en/3.2.2/config/auth.html#chttpd_auth.
>
> Also you likely need to set those Couch config keys:
> — csp / attachments_enable = false,
> — csp / showlist_enable = false
> — chttpd_auth / same_site = lax
>
> Also, if you use proxy auth, you might need to tune [chttpd] config
> section: add {chttpd_auth, proxy_authentication_handler} into chttpd /
> authentication_handlers and restart Couch.
>
> Hope it helps.
>
> ermouth
>
>
> On Sat, Jul 23, 2022 at 5:51 AM Alan Malta <al...@gmail.com> wrote:
>
> >
> > keep CouchApps functional (same behavior of 3.1.2?) in 3.2.2? Or is
> moving
> >
> >
>

Re: Using CouchApps in Couch 3.2.2

[ermouth <er...@gmail.com>]

Hi,

CouchDB hosted apps generally work ok in 3.2.2, however small config
tune ups required after upgrade from 3.1.

First you need to carefully copy 3.1 config, considering [couch_httpd_auth]
members moved to [chttpd_auth] since 3.2. Read more here
https://docs.couchdb.org/en/3.2.2/config/auth.html#chttpd_auth.

Also you likely need to set those Couch config keys:
— csp / attachments_enable = false,
— csp / showlist_enable = false
— chttpd_auth / same_site = lax

Also, if you use proxy auth, you might need to tune [chttpd] config
section: add {chttpd_auth, proxy_authentication_handler} into chttpd /
authentication_handlers and restart Couch.

Hope it helps.

ermouth


On Sat, Jul 23, 2022 at 5:51 AM Alan Malta <al...@gmail.com> wrote:

>
> keep CouchApps functional (same behavior of 3.1.2?) in 3.2.2? Or is moving
>
>