我可以限制未经身份验证的用户访问 _all_docs 吗？
我希望人们能够使用带有随机 ID 的链接私下共享文档，就像我将私人链接发布到 Pastebin 后得到的那样。我想总体了解 CouchDB 和 Cloudant。
I'd like people to be able to share documents privately, using a link with a random id, like I get after posting a private link to a pastebin. I want to know both for CouchDB and Cloudant in general.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
对于 Apache CouchDB，读取权限是针对每个数据库的，而不是针对每个文档。如果用户可以从数据库中获取文档，则用户也可以获取
_all_docs?include_docs=true。我在这个问题中写了关于CouchDB读取授权的详细信息。
有几种方法：
第 7 层防火墙或反向 HTTP 代理。这很难正确地做到； IMO 对大多数人来说不可行。您必须非常熟悉 CouchDB 的 API，以确保阻止每个可能的查询（例如，
_rewrite绕过您的过滤器）。每个用户一个数据库。这是CouchDB 的原生解决方案。创建数据库非常便宜。然后，将用户可以看到的文档复制到他或她的数据库中。用户需要 Couch 上的密码或 OAuth 帐户。
我最近在每用户数据库方面取得了成功，但 URL 中还有一个唯一的密钥，可以让他们立即访问。这感觉就像你想要的东西，但在幕后我只是用随机密码创建一次性帐户。该链接会转到公共页面，例如
www.example.com/pastebin/index.html?doc_id=some_docid&secret=random_secret。然后浏览器上的 Javscript 将读取window.location并将该密码插入到 AJAX 查询中（在授权标头中）。沙发授予许可，用户很高兴。不幸的是，这需要一些尝试和错误。不过，这主要是简单的 Web 编程。With Apache CouchDB, read permission is per-database, not per-document. If a user can fetch a document from a database, the user can fetch
_all_docs?include_docs=truetoo.I wrote details in this question about CouchDB read authorization.
There are a few approaches:
Layer-7 firewall or reverse HTTP proxy. This is hard to do correctly; IMO not feasible for most. You must be very familiar with CouchDB's API to be sure every possible query is blocked (e.g.
_rewritegoing around your filter).One database per user. This is CouchDB's native solution. Creating databases is very cheap. Then, replicate the documents the user can see to his or her database. The user needs a password on the Couch, or an OAuth account.
I have had success recently with per-user databases but also a unique key in the URL that grants them immediate access. It feels like the thing you want, however under the hood I am just creating throwaway accounts with random passwords. The link goes to a public page such as
www.example.com/pastebin/index.html?doc_id=some_docid&secret=random_secret. Then Javscript on the browser will readwindow.locationand insert that password into the AJAX query (in an Authorization header). Couch grants permission and the user is happy. Unfortunately, this required a little bit of trial and error; however it's mostly simple web programming.