Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Simple API with Nginx and PostgreSQL

rny.io

Post reply on HN
Print view View original

21–30 of 74 posts

Re: Simple API with Nginx and PostgreSQL

#21

Post by hedonist »

ricny046 wrote: post #4
kclay wrote: post #2

Pretty neat, what about SQL injections?

This example is not secured against SQL injections but you can do it easily. Look at the documentation here: https://github.com/FRiCKLE/ngx_postgres/

Yeah but by the time we've taken care of injection issues (and handled all the other gotchas that haven't been articulated yet), we've written about as much boilerplate as we would for just about any other scripting language / framework, wouldn't we?

Don't get me wrong -- it's still a pretty neat idea. It's just there's that "other 90%" (i.e. the necessary work to create anything seriously production grade) that always comes to mind when evaluating a new interface.

Re: Simple API with Nginx and PostgreSQL

#22

Post by jallmann »

stevewilhelm wrote: post #10

How does one do user authentication and resource authorization?

Auth Basic can be done directly against postgres, plus a few more modules (headers-more and eval was how I did it, IIRC). Could probably do it with just openresty too.

After authentication, you have the credentials needed check authorization, it'd probably just involve a few changes to the SQL in the article.

Re: Simple API with Nginx and PostgreSQL

#24

Post by mfenniak »

jahewson wrote: post #17

I really like the simplicity of this approach, but are the Postgres calls asynchronous? If not, it won't scale...

I think the answer is yes, it performs the calls asynchronously. I've been searching through the source code for the postgres module (https://github.com/FRiCKLE/ngx_postgres), and it appears to use the libpq asynchronous API (http://www.postgresql.org/docs/9.2/static/libpq-async.html).

Of course, one could easily use the async API in a non-async manner, so I'm not 100% certain.

Re: Simple API with Nginx and PostgreSQL

#25

Post by stevoski »

This article gives a good example of why you SHOULD consider using an existing framework to create a REST API.

I see no concern about authentication, authorisation, scalability, protection from SQL injection attacks, nor making the output easily parseable by third-party applications.

None of these are issues you can simply say, "I'll deal with that later when it becomes a problem." They are reasons why an existing framework is helpful.

Any example of a web application using a database should NOT be using string concatenation for adding field values to an SQL statement. Ever. Really.

Re: Simple API with Nginx and PostgreSQL

#27

Post by iamlacroix »

moens wrote: post #19
taf2 wrote: post #5

very cool, add in some lua scripting and you can get some pretty solid single purpose endpoints: http://wiki.nginx.org/HttpLuaModule maybe not perfect for a whole app but maybe depending on your goals.

Can you recommend a public repo which demonstrates use of the HttpLuaModule? [Edited to add:] Another comment mentions the Lapis framework which gives [me] a good starting point. @subs: thanks!

You can also check out a simple example[1] used for the TechEmpower Benchmarks[2].

[1]: https://github.com/TechEmpower/FrameworkBenchmarks/tree/mast...

[2]: http://www.techempower.com/benchmarks/

Re: Simple API with Nginx and PostgreSQL

#29

Post by justincormack »

moens wrote: post #19
taf2 wrote: post #5

very cool, add in some lua scripting and you can get some pretty solid single purpose endpoints: http://wiki.nginx.org/HttpLuaModule maybe not perfect for a whole app but maybe depending on your goals.

Can you recommend a public repo which demonstrates use of the HttpLuaModule? [Edited to add:] Another comment mentions the Lapis framework which gives [me] a good starting point. @subs: thanks!

There is a presentation here that goes through the basics. http://www.londonlua.org/scripting_nginx_with_lua/index.html

Re: Simple API with Nginx and PostgreSQL

#30

Post by rgbrenner »

stevoski wrote: post #25

This article gives a good example of why you SHOULD consider using an existing framework to create a REST API. I see no concern about authentication, authorisation, scalability, protection from SQL injection attacks, nor making the output easily parseable by third-party applications. None of these are issues you can simply say, "I'll deal with that later when it becomes a problem." They are reasons why an existing fr…

"protection from SQL injection attacks"

In the module he's using, there is a postgres_escape function.. so there's no reason he couldn't have used it.

http://labs.frickle.com/nginx_ngx_postgres/README

Post reply on HN