Re: [Exist-development] Security

[Thomas W. <tho...@gm...>]

On 6 February 2012 23:14, Hungerburg <pc...@my...> wrote:

> # Exposing all of db through the "apps" namespace in addition to the
> "rest" namespace, from the "security is a process" standpoint, does not
> look a good decision. MVC theory instead proposes, to store
> (confidential) data outside of the web-root.
>
>
I agree to expose the whole db under /apps is not a very good idea. When
give access to the db we should limit it to a collection that is dedicated
for this purpose. Something like /db/apps. This way there will be a clear
separation between the data and the applications, nicely located in a
single place. The application's code will access the rest of the db if and
when needed in a controlled manner.

So my proposition is to change the redirection /apps - > /db    to /apps ->
/db/apps

Thomas