Hacker News Reader

The reason it's less robust is that I could use curl to send a DELETE request for records I shouldn't be able to delete. Or POST some data saying my order is paid in full. Business logic that matters at all has to be validated by some authority. The client is never good enough.

View on HN

That's the purpose of the sync-gateway(in couchdb's case), it handles authorisation of actions against couchdb.

Just because I'm authorized to create a record doesn't mean it's a valid record. Take my new order example. If all business rules, including payment authorization and payment record keeping, are handled client side, I can easily say that a valid payment has been made when it hasn't.

I can see how there's a class of applications that would need the level of verification you're talking about(payment authorization being a good example). Many apps don't need that level of verification though, an app like trello for instance only needs to authorize actions against an entire resource, not values within a resource.

On the other hand, if your app has no business rules, one would assume that your server-side application is going to be extremely thin.

you can do the same with psql, rails bin commands, php, or anything else that can talk to the db

Which is precisely why your DB server is behind your firewall.

Reply on news.ycombinator.com