An Alternate Method of Enabling White-list Training

With the latest updates to the rdbhost.jquery.js jQuery plugin, coding front-end applications using the full power of SQL is even easier.

For those readers not familiar with the Rdbhost.com system, let me recap:

Rdbhost provides SQL databases accessible, safely and directly, from browser code.    Just write SQL inline in your JavaScript application, the SQL will be submitted to the Rdbhost server as needed, validated, and executed.  Results or an error message are then returned to the client.

Validating the SQL submitted is managed by comparing SQL queries with a white-list, and that white-list is populated by a training process.   Previously, that training process was enabled by going to the Rdbhost.com website, and enabling training for your client IP.   The white-list would then be populated by running the client application to submit necessary queries.  After the training is complete, the training would be disabled from the website account management pages.

The prior two paragraphs describe how the system has worked until now, and that method will continue to be available.  However, there is now an easier way, a way that contributes to an even nicer workflow.

The rdbhost.utils.jquery.js plugin includes some new methods, allowing training to be authorized from the client app:


$.preauthPostData({opts...});

The options object can have exactly the same elements as the $.postData method, used in the same way.  The difference from $.postData is that when the request fails on a white-list error, the $.postData method will just return an error, bu the $.preauthPostData call will allow you to enable training mode briefly and resubmit the request.  It will show you an html dialog box for receiving the account email and password, get those from you, and then use them to enable training briefly (8 seconds), and immediately resubmit the request.  The second submission would successfully white-list the query.


There is a similar method for form submissions, that works analogously:


$.preauthPostFormData(form, {opts...});

The parameters are the same as $.postFormData, and used the same way.  It prepares the form just as $.postFormData does, but if the submission results in a white-list error, it responds as above to temporarily enable training, and resubmit the form.

The significance of these two new methods is that you no longer need to log-in to the Rdbhost website to enable training for each session, but can enable it on a query by query basis.   If the once per session enabling seems more efficient, it is still available.

Automated Backups

Regularly Scheduled Backups to S3

Backing up your account to Amazon S3 has been a feature here for years.  Now, you can schedule automated backups, where your Rdbhost account is dumped to your S3 account on a regular basis.

You can arrange the backup to be done on a regular interval from 15 minutes to 7 days.  The backups are put in the S3 bucket you designate in your S3 config page, and are named with the date and time, as well as the account id.

Generally speaking, managing the dump files in your S3 account is your responsibility, manageable through Amazon's own management pages.  However, we do offer one tool to help.  After each backup, you can have Rdbhost prune the backup file collection, based on simple rules.

The first rule is a maximum age, where every backup over that age gets deleted.   The second rule is a percentage limit; each backup cannot be older than a given percentage of the next older backup.  For example, if your oldest backup is 10 months old and your configured percentage is 90%, the next oldest cannot be older than 9 months, and the one before that can only be 8 months, 3 days old, and so forth.

This pruning can help in keeping your S3 account from getting too large, too quickly.

TodoMVC, Rdbhost style

The TodoMVC project was created to help people choose a JavaScript MVC framework.  It includes a couple dozen implementations of the same HTML5 app, a Todo list.   Each implementation uses a different JavaScript framework.  Each of them uses the browser's localstorage for Todo storage, avoiding any specific back-end dependence.

Rdbhost has its own version of this TodoMVC project.  Here, the intention is to show how each framework can be used with the Rdbhost.com backend.   So far, I have implemented versions for the most popular 5 frameworks, AngularJS, Backbone, KnockoutJS, Ember and CanJS.   I may add more in time.

Each back-end interface is fairly minimal;  For AngularJS and KnockoutJS, it uses a singleton blob in the database for all Todo records.  Backbone, Ember and CanJS have a CRUD type back-end interface, and for each of those, I created a table with one record per Todo, and a CRUD-style client-side adapter to put and get data.  Each framework project includes a page 'initialize.html', that requests the Rdbhost account password, gets the super authcode with that, and sets up the necessary tables.

AngularJS seems to include an integrated backend data retrieval API, and I may re-implement the AngularJS TodoMVC to use a more sophisticated approach.


Find the working site at:  http://todomvc.rdbhost.com .
Code is at: https://github.com/rdbhost/todomvc .

Enjoy

#nobackend

#nobackend

The 'nobackend' meme has gotten some discussion among the G+ and twitter accounts I follow.  I was excited at initial review, as it seemed to be very inline with Rdbhost's goal of enabling Web App development without any server coding.

On further examination, I found the key documents to be hazier then I had briefly hoped;  the expressed goal is to incite discussion on the objective of writing front-end code 'without thinking about the back-end'.

Rdbhost's power is in moving the critical custom back end design elements, such as database schema and database queries, to the front-end.  Moving them to the front-end is more pragmatic than ignoring them altogether, though perhaps less appealing to many front-end devs.  ;)

Nonetheless, I want Rdbhost.com to be part of the discussion, so I have implemented their sample app, an html5  invoicing app, using Rdbhost as the backend.  Read about the reference app, and the while #nobackend promise, at nobackend.org.

The Rdbhost version of the app is at http://invoice.rdbhost.com ,  and the source is at http://github.com/rdbhost/EditableInvoice .  The entire code base for the app is in that Github repository. There was *no* code deployed to the server in support of this specific app.

I used OpenId as the only login option.  The code to setup the necessary server-side tables is in /initialize.html .

Find the JavaScript API at: github.com/rdbhost/Rdb.Js/.

David Keeney

The Rdbhost server was upgraded this weekend.

Now, it supports Postgresql 9.2.   Aside from the general goodness of having the latest version available, this version supports some new embedded languages.  The new languages are not available just yet on rdbhost, but stay tuned.

David
dkeeney@rdbhost.com

Attention Rdbhost Clients

If you have an active JavaScript application relying on an Rdbhost.com account, you should consider upgrading your app, to use current libraries.

If you are using jquery.rdbhost.exdm.js from www.rdbhost.com, loaded by your app from our server, and you do not use the openId log-in methods, and you use a recent version of jquery (>= 1.5) then you are probably ok as-is.  Your app will load the current version, and all is well.  Please check, this week, and again next week, to verify correct behavior.

Otherwise, upgrade.  Use either the current jquery.rdbhost.exdm.js from our server, or get the current version from our github repository.  Load it after a recent version of jQuery (version >= 1.5).

The compelling reason to upgrade is that server-side support for cookie processing is being dropped soon.  The protocol included the ability to interpolate cookie values into queries, as a convenience to the programmer.  Unfortunately, this facilitates clients creating Cross-Site-Forged-Request (CSFR) vulnerabilities.   So, to avoid this hazard, I re-coded the JavaScript module to handle cookies client-side.  Now, it converts the cookie tokens into regular named parameters, and adds the cookie values to the named parameters hash. Now, the server should never see cookie tokens in any query, and in a week or so, the server side support will be dropped.

Other than this, there are numerous improvements.  OpenId logins work better now, as a reliance on iframes has been removed.  The Rdbhost jQuery plugin methods now return Deferred promises, as appropriate;  this behavior is similar to current jQuery ajax behavior.  You (the account owner) can now login to your account via an API call.

Cookies are Harmful (in single-page apps)

Do not use cookies in your single-page app.

At least, don't have your server use cookies from your single-page app.  Having the app write a cookie provides some state persistence when the user insists on rattling the reload button.  The server should ignore the cookie, relying only on input submitted with each request explicitly.

Cookies are obsolete, dating from the early 1990s, when Netscape invented them to add state to a stateless protocol.   Their purpose was, and is, to allow the server to track a user session between page requests.

Your single-page app has no use for cookies.  Just keep state in variables and in the DOM in the browser, and send the authentication with each and every ajax request.  It is simple, reliable, and safe.

Why the fuss?  Well, using cookies (or web server authentication, for that matter) sets your application up for a cross-site-request-forgery  (CSRF) attack.   You don't want that.    A CSRF attack involves another website 's page secretly submitting a request to your site, using passive authentication credentials stored in the user's browser, to do things within the users account on your site without the user's knowledge or approval.

The way to avoid CSRF attacks is simply to avoid passive authentication methods, such as cookies or web server authentication.  I call these passive, because they do not require explicit inclusion in a given request; the browser automatically adds them to any request on your site.  The absence of passive authentication credentials means no successful CSRF attack is possible.

We should consider cookies obsolete and dangerous, in the context of any single page app, and single-page apps are where the web is, now, in 2013.

OK, maybe your website is a small collection of single-page apps, and needs to maintain session between these multiple apps;  if so, then maybe you need to use cookies to maintain state, but don't tell the server.  One app can create a cookie client-side, and the browser will make it available to all single-page apps on the domain.  The apps know user session state from the browser cookie.  That the cookie gets sent to the server regularly is merely an undesirable side effect, and that side effect can be ignored.  Just don't read that cookie in any server code; it cant be used in a CSRF attack if the server refuses to recognize it.  If your app is an html5 app, not needing legacy compatibility, then use web databases or some cookie alternative that doesn't get sent to the server.

There is a common counter-CSRF technique that calls for including some arbitrary value in both a cookie and either the request header or request fields.  If you can put the cookie content into the request in addition to the cookie, you can put the content in the request instead of the cookie.

Cookies are bad for your single page app.  Avoid them.