验证 CouchDB 中的 API 密钥
我最近对 CouchDB 产生了兴趣，并想尝试围绕它构建一个小型应用程序。
我当前邀请系统的方式是，请求提供两个内容：一个 id、一个 API 密钥和一个格式。 ID 是数据库中文档的 _id，API 密钥是具有属性 {"valid" : true/false} 的另一个文档的 _id，格式是他们想要返回的格式。如果 API 密钥有效，系统将以请求的格式为给定的 ID 生成显示页面。否则，它将返回 403 统计代码。
不幸的是，我找不到从显示页面提取另一个文档的方法。我刚刚开始使用 CouchDB，所以也许我缺少一些简单的东西。
I became interested in CouchDB recently and wanted to try and form a small application around it.
The way how I invition my system currently is that requests come providing two things, a id, a API Key and a format. The ID is the _id of a document in the database, the API Key is a _id of another document that has a property of {"valid" : true/false}, and the format is the format they want back. If the API Key is valid, the system would generate the show page for the id given, in the format requested. Otherwise it would return a 403 stats code.
Unfortunately I can't find a way to pull up another document from a show page. I am just beginning CouchDB, so maybe there is something simple here I'm missing.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
对于
_show函数，涉及三个部分：对于 URL 格式
/db/_design/ddoc/_show/ my_show_func/otherdoc：_design/ddocshows.my_show_funcotherdoc的 _id这些是涉及的仅有两个文档。我认为执行您所描述的操作的唯一方法是为每个 API 密钥提供一个设计文档。用户将查询
/db/_design/API_KEY/_show/other_doc_id。 CouchDB 很轻松。数千个具有相同或相似_show功能的设计文档并没有什么问题。您可以根据需要使用 HTTPCOPY方法将基本设计文档克隆到新的 API 密钥。然后，您可以通过删除设计文档来撤销 API 密钥。然而，这显然是一种独特的方法，值得三思。最后一个考虑因素是（使用默认的 CouchDB、无反向代理、mod_security 等）如果用户可以读取一个文档，他们就可以读取整个数据库（例如，从
_all_docs查询）。因此显示功能只是软件的一种便利，而不是安全网关。With a
_showfunction, there are three parts involved:For the URL format
/db/_design/ddoc/_show/my_show_func/otherdoc:_design/ddocshows.my_show_funcwithin that design document_idofotherdocThose are the only two documents involved. The only way I can think to do what you describe is have a design doc per API key. The user would query
/db/_design/API_KEY/_show/other_doc_id. CouchDB is relaxed. There is nothing wrong with thousands of design docs with identical or similar_showfunctions. You coul use the HTTPCOPYmethod to clone a base design doc to a new API key as needed. Then you could revoke an API key by deleting the design doc. However that is obviously a unique approach, worth a second thought.A final consideration is (with the default CouchDB, no reverse proxies, mod_security, etc.) if a user can read one document, they can read the entire database (e.g. from the
_all_docsquery.) Therefore show functions are a convenience for the software but not a security gateway.