amvorg-underground/catalog — Issue #2: Design and implement login
Author: yipdw
Created: 2012-03-06 10:08:04+00:00
State: open

Embracing CouchDB (#1) showed me that it is not only possible, but indeed desirable, to move authentication and authorization into CouchDB. The process is very simple: we establish a one-to-one mapping between application user and CouchDB user, use CouchDB's session API to retrieve a CouchDB token on login, and store that token in the session. Because the session is protected against forgery, it is safe from modification by the user, and transmitting login data over HTTPS puts up an effective block against session capture.

I will feel more comfortable proceeding with feature development once that infrastructure is in place. The helper methods I developed to use `Net::HTTP::Persistent` with CouchDB expect credentials to be supplied for all datastore-mutating methods, and it feels dirty (as it probably should) to pass administrator credentials around the application.