0

Lets suppose that I have some web app that using backbone.js in the client side, and on the server side some RESTful API that support the DELETE method. The database of the app contains some categories and posts, and on the client side I have collection that called "categories" that using fetch() to retrieve all the categories from the server using GET method.

How can I prevent from any user to just open his console in chrome or firebug in Firefox, explore my JavaScript files, figuring the structure of my backbone models and just run collections.destroy() from his console and delete all my database....

Am I missing something here?

I've googled it but didn't find an answer...

1
  • 1
    Don't trust the client side. You should prevent from back-end. Jan 25, 2013 at 17:22

2 Answers 2

1

You have to put up some validation on your server side since you cannot trust what came from the client.

For example you could write some security checks that run before execute the database's calls, like these (PHP pseudo-code):

$model = Posts;

if($model->checkUserRights('read')) {

    $model = Posts->findById($_GET['id']);

    echo json_encode($model);

} else {

    echo "You have not the require rights to access ".$model->tableName;

}

And in Posts's model:

public function checkUserRights($op){

    // Run some code for each possible operations's type   
}

You could also add some rules to filter the values you will return to the clients or the values they will post to your server, before process an update request.

It's really up to you and what technology you will use on your server.

1

You can easily prevent this on the server side by not doing anything when the DELETE method is received from the client.

If you're using rails, your delete method would look like this

def destroy
  #not allowing deletions through the REST api
end
2
  • OK, but what if I need this method?? How can I use it safely?? I want that my client will be able to edit their data but prevent from them to mess all up?? Just simple validation on the server side?
    – guyklainer
    Jan 25, 2013 at 17:46
  • If they are deleting categories through the browser console, then they know they can be messing things up. 98% of your users will not even know javascript and the other 2% that do know it won't care enough to spend the time to figure out how to delete categories through the console.
    – Paul
    Jan 25, 2013 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.