1

Ok I have a couple of questions here. First let me give you some background information. I'm starting a project where I have a node.js server running my application and my website running on another normal server. My application will allow multiple users simultaneous connections and updates to the database so Redis seemed like a good fit there because of its speed and atomic functions.

For someone to access my application they have to login with an account. To get an account, they have to signup for one through my website. So my website needs a database, but its not important to have a database like Redis here because it doesn't need it. Which leads me to my first question:

1. Can Redis even be used without node.js?

It seems like it would be convenient if both of my servers were using the same database to keep track of information. In some cases, they will keep track of the same information (as in user information) and in other cases, they will be keeping track of separate information. So even if the website wouldn't be taking full advantage of all that Redis has to offer it seems like it would be more convenient. So assuming Redis could be used in this situation that leads to my next question:

2. Since Redis is linked with JavaScript, how would I handle the security from my website users?

What would be stopping my website users from opening firebug or chrome's inspector and making changes to the database? Maybe if I designed my site with the layout like this: apply.php->update.php->home.php. Where after they submitted their form it would redirect them to the update page where the JavaScript would run and then redirect them after the database updated to the home page. I don't really know I'm just taking shots in the dark at this point. :)

Maybe a better alternative would be to have my node.js application access its own Redis database and also have access to another MySQL database that my website also has access to. Or maybe there is another database that would be better suited for this situation other than Redis. Anyways any direction on this matter would be greatly appreciated. :)

Improve this question

1 Answer 1

Reset to default
2

What would be stopping my website users from opening firebug or chrome's inspector and making changes to the database?

If this is possible, you've got some serious redesigning to do. All your authentication should be on the server end of things. Your node server should be validating the request before it takes any action. End users fiddling with javascript should not be able to perform any action they couldnt already do in the web interface.

This has absolutely nothing to do with the database being used. I'd advise you not to even worry about selecting a DB until you've worked out the above.

Addendum

In response to Aust's question below.

But if I wrote my code to have the website connect to Redis, then that's when I would run into security issues, yes?

Yes, thats a huge security problem. You shouldnt be writing directly to the database from the web browser. For starters, doing so requires that you'd give out database user/pass to every web client. Rather, have your javascript code talk to another app on your server, and have that app interact with the database. Your intermediary app (aka, app server, web service, middle tier, etc) should authenticate the user and then only allow actions that user is allowed to do. The web client should have no idea that a database even exists.

Improve this answer
7
  • If this is possible... Yes that was my question that you didn't answer. ;) Is that possible? I disagree with you when you say This has absolutely nothing to do with the database being used. and this is why: Redis runs on JavaScript. When it is on a node.js server it is fine because users don't have access to the JavaScript being executed on the node.js server. But if the website is connecting to Redis then it seems that users would have access to that JavaScript and could manipulate it. Is that true or false?
    – Aust
    Sep 28, 2012 at 4:47
  • 1
    @Aust Redis runs on JavaScript is false. Redis has nothing to do with javascript. Node.js applications connect to Redis over a tcp/ip socket. Javascript on browser cannot manipulate Redis; unless you explicitly write code to allow it.
    – Sripathi Krishnan
    Sep 28, 2012 at 5:00
  • @SripathiKrishnan - Ok cool. But if I wrote my code to have the website connect to Redis, then that's when I would run into security issues, yes?
    – Aust
    Sep 28, 2012 at 15:36
  • @Aust - If you don't write secure code then yes, you could run into security issues.
    – Sripathi Krishnan
    Sep 28, 2012 at 15:54
  • @Aust see my above edits
    – GrandmasterB
    Sep 28, 2012 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.