Simple API with Nginx and PostgreSQL
1–10 of 74 posts
Re: Simple API with Nginx and PostgreSQL
#2Pretty neat, what about SQL injections?
Re: Simple API with Nginx and PostgreSQL
#3Pretty neat, what about SQL injections?
looks like that door is wide open
Re: Simple API with Nginx and PostgreSQL
#4Pretty neat, what about SQL injections?
This example is not secured against SQL injections but you can do it easily. Look at the documentation here: https://github.com/FRiCKLE/ngx_postgres/
Re: Simple API with Nginx and PostgreSQL
#5very cool, add in some lua scripting and you can get some pretty solid single purpose endpoints: http://wiki.nginx.org/HttpLuaModule
maybe not perfect for a whole app but maybe depending on your goals.
Re: Simple API with Nginx and PostgreSQL
#6Pretty neat, what about SQL injections?
This example is not secured against SQL injections but you can do it easily. Look at the documentation here: https://github.com/FRiCKLE/ngx_postgres/
To clarify, it looks like "postgres_escape" is the way to do escaping.
Unfortunately, it seems a bit awkward to differentiate between empty and NULL strings. That's something to be careful of.
Also, I really think this should be included in the blog post, even if it's simple. Protecting against SQL injection is not optional, so leaving it out only muddies the comparison with more traditional frameworks. Also, there's always going to be someone that copies and pastes it without thinking much about it.
That being said, this is very cool and I hope to see more development and exploration in this area.
Re: Simple API with Nginx and PostgreSQL
#7If you created stored procedures in postgresql that accepted a json/hstore argument, you'd have a pretty flexible/fast system here.
i.e. PUT to "/api/blah" with {"id": 1, "name": "Joe"} could call the update_blah stored proc passing in that json.
Re: Simple API with Nginx and PostgreSQL
#8Interesting. I'd like to see how you implement role based access control and sql injection safeguards. How would you define complex validation schemes? In stored procedures?
Re: Simple API with Nginx and PostgreSQL
#9Earlier quoted context omitted.
This example is not secured against SQL injections but you can do it easily. Look at the documentation here: https://github.com/FRiCKLE/ngx_postgres/
To clarify, it looks like "postgres_escape" is the way to do escaping. Unfortunately, it seems a bit awkward to differentiate between empty and NULL strings. That's something to be careful of. Also, I really think this should be included in the blog post, even if it's simple. Protecting against SQL injection is not optional, so leaving it out only muddies the comparison with more traditional frameworks. Also, there's…
Good point. I will update the examples in the blog post as soon as possible.
Re: Simple API with Nginx and PostgreSQL
#10How does one do user authentication and resource authorization?