iriscouch/browserid_couchdb — Issue #9: replication with browserID auth?
Author: gfxmonk
Created: 2012-02-14 09:21:07+00:00
State: open

Less of a bug, more of a request for help / ideas. I couldn't find a newsgroup, but let me know if there's a better avenue for this.

I have a couchApp I'm writing, and I want to be able to have the following setup:
- upstream couch, hosted somewhere globally available (with a private DB per user)
- local couch (running on localhost), for when network is unavailable (with only the user's DB)

I'd like to use replication to sync the two when the network is up, but can't figure out how to do this securely. Obviously, I'm using browserid on the hosted couch. For the local couch I haven't decided if auth is necessary. The local couch should not be exposed to the internet, so it will have to be the one to initiate replication.

I can do this hackily right now if I grab the cookie header from a browser session auth'ed into the hosted couch, and put that header in the replication parameters that I submit to my local couch. I do this by manually using firebug, and I can't see any way to make this happen automatically (certainly not without a wrapper program running locally that can get around same-origin restrictions).

Would it be possible to somehow use browserID locally, but initiate an assertion to be generated for myhostedcouch.com instead of localhost? And then further to that, I'd need a way to send that assertion to the upstream couch in the replication paramaters (instead of sending a cookie, because obviously I couldn't generate a cookie locally that would be recognised by the upstream server). Presumably, a header would suffice but this would need to be explicitly added to browserid_couchdb.

So firstly, is that a plausible thing to look into? And secondly, is it an intrinsically bad idea (because it leaves a glaring security hole, for example).

Are there any other good ways to replicate with a couch that only uses browserid for auth?