Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Here is what I am trying to do and can anyone provide some best practice advice for authentication and security?

Each user will have their own private database on the cloud. He will have his local couchdb on iOS/Android. My iOS/Android app will replicate between mobile and the cloud. Users can also access their data on the cloud from the web. I am using CouchDB authentication and there is no middle tier. When a user sign up for a new account, I will create a new database in the cloud with his account name. I compared Iris Couch and Cloudant and and chose Iris Couch because Cloudant doesn't give me admin privilege to achieve this.

My questions:

  1. Is it a good idea or possible for the iOS/Android/Web client to have admin privilege to create a new database when they sign up for a new user account? I could hard code the admin username and password on the iOS/Android clients but that feels very wrong. For the web client, I won't have the option to hard code the admin password at all. Alternatively, I can setup a new machine in the cloud to monitor _users database changes and create new databases accordingly.
  2. Shall I use the user's credential to replicate between mobile and cloud?
  3. I am using Iris Couch for hosting. What is the best way to integrate Facebook authentication into my authentication model? I saw this plugin but does it require my own hosting and making changes to the server?

https://github.com/sander/CouchDB-Facebook-Authentication

Out of curiosity, I also look at Cloudant hosting. But it doesn't look like I can create CouchDB users and support my database-per-user model. I don't have admin access to _user database.

share|improve this question

migrated from stackoverflow.com Jul 8 '11 at 12:55

This question came from our site for professional and enthusiast programmers.

add comment

1 Answer

  1. No. You shouldn't hardcode admin credentials into the client code. Have you considered running a server whose public interface has exactly one operation it supports (create_new_user)? Or implementing a stored procedure in the database to support this operation (if CouchDB supports stored procedures)?

  2. I don't understand what you are asking here. Maybe more explanation is needed?

  3. I don't know.

P.S. Since you have 3 questions, I suggest asking them separately. I think you are more likely to get useful responses that way.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.