This questions is more of a higher level question about MongoDB app structure.
I am currently building an App that can do User to User messaging using a MongoDB. Everything works great so far, but I am wondering if my design would lead to security issues.
I have a "UserDB" with a Collection "Users". In the collection, "Users" it stores documents of each Users data (Username, Password, ListOfMessages).
When one user sends a message to another user the structure is like this:
User1 wants to send a message to User2
User1 checks if User2 exists in the Collection
if User2 exists, then add new Message to User2's list of Messages from User1
Add the same message to User1 and mark as sent.
What I am concerned about is, should one user be able to access and modify another users data that way? I am concerned about potential hackers.
Any advice or resources would be appreciated.
Thanks!
It's not security issues that you'll run into, but rather scalability issues. For security, however, you should be encrypting your passwords and looking into security for password management.
But with this implementation you'll run into scalability issues. You don't want documents in your collections (your Users in this case) to be growing arbitrarily large (source: https://www.reddit.com/r/mongodb/comments/573fqr/question_mongodb_terrible_performance_for_a/).
Instead, you should create a new collection: Messages.
Each message will have documents like: {fromUser, toUser, message, date, ...}.
Related
I have a use case where I want to connect two different user roles, and if they accept and want to connect, new features will open up. It is very similar to how friend requests work at Facebook or LinkedIn, opening up and showing more content. Let's call them role1 and role2.
All users are stored within a "users" collection with an id. Depending on their provided role within the document attached to the "users" collection, they can store additional data in their respective role-collection, i.e., role1 collection or role2 collection.
What is the best approach and structure to connect the two users, i.e., become "friends"? Should I have the connection stored in a new collection, named perhaps connections-collection, or multiple collections?
I'm using Next.js, NextAuth for user authentication, and FaunaDB as a database. I'm using Fauna's query language, FQL.
Have you perhaps seen fireship's video RE: fauna db? I think it covers what you want to do and how you can proceed.
Edit: There are many ways to implement this. Based on my understanding, perhaps you can have "Friends" and "Requests" arrays stored under a user document. That way you can differentiate between confirmed friends or a just request.
Example: When user1 initiates a friend request with user2, you store user1's ref under "Requests" of user2's document. When user2 confirms, you move user1's ref to the "Friends" array.
This is just a overly simplified idea and you may need to consider your options and the implications. You would need to plan and define the predicate in both roles so you would only see what is necessary.
Im very new to Android development. At the moment I am trying to develop my first app. My app is going to have a friend-system. Im trying to setup the Firestore-database to match my conditions.
I want to use the UserID provided by the google authentication to control the access of the database.
Every user has a friendlist of usernames,since I think, its not safe to let any client know the UserID of another client.
My Firestore database looks like this:
"users" (collection)
UserID (document)
DisplayName, Username (fields)
"friendlist"
UserID
Username1,Username2,Username3...
Everytime I want to access data of a user inside my friendlist a have to retrieve data from the users-collection using the UserID-document. Since the client isnt allowed to know the UserID of the friend, I need another collection which I am planing to access through cloud functions to know which userID belongs to the username.
"usernames" (collection)
Username (document)
UserID (fields)
Is there a better way to minimize database-reads while protecting database accesses?
You could try looking for the UserID(document) based on the Username filed taking the answer from this other thread as a starting point.
Nevertheless, you would need to make sure that the Usernames do not repeat as this may cause issues later on by programming a check in the insertion of updates of usernames.
Otherwise, the solution you are planning would work although with the caveat that you may get a higher billing in the future as you are billed for every read as mentioned here.
Hope you find this useful!
What's the best practice or the common way of keeping (or not keeping) Evernote users in your application's database?
Should I create my own membership system and create a connection to Evernote accounts?
Should I store Evernote user data (or only part of it) in my own app and let the user log in only with Evernote?
Summary: you must protect their data but how you protect it is up to you. Use the integer edam_userId to identify data.
I think the API License agreement covers protection in the terms:
you agree that when using the API you will not, directly or indirectly, take or enable another to take any of the following actions:...
1.8.4 circumvent or modify any Keys or other security mechanism employed by Evernote or the API;
If you cache people's data and your server-based app lacks security to prevent people looking at other's data, then I think you're pretty clearly violating that clause. I think it's quite elegantly written!
Couple that with the responsibility clause 1.2
You are fully responsible for all activities that occur using your Keys, regardless of whether such activities are undertaken by you or a third party.
So if you don't protect someone's cached data and another user is able to get at it, you're explicitly liable.
Having cleared up the question of your obligations to (as you'd expect) protect people's data, the question is how do you store it?
Clause 4.3 covers identifiers pretty directly although it's a bit out of date now that we are all forced to use oAuth - there are no passwords ever entered into anything other a web view. However, mobile or desktop client apps must provide a mechanism for the user to log out, which must completely remove the username and password from your application and its persistent storage.
For a web app, you can't even save the username: If your Application runs as an Internet service on a multi-user server, you must not ask for, view, store or cache the sign-in name or password of Evernote user accounts.
The good news is that you can rely on the edam_userId value which comes back to you in the oAuth token credentials response, as discussed here.
When you look at the Data Model, you can see the unique id under the User and going into the User struct, see the reassuring definition The unique numeric identifier for the account, which will not change for the lifetime of the account.
Thinking about the consequences, as you can't get the user id until you have logged into the service, if you want to provide a local login for people you will have to link your local credentials to the user id. That may irk some people if they have to enter a username twice but can't be helped.
You can allow users to log-in via OAuth. Here's a guide on how that process works.
But you'll probably also want to store a minimal amount of user data, at least a unique identifier, in your database so you can do things like create relationships between the user and their notebooks and tags. Refer to the Evernote data model for those relationships. If you're using rails, this will also help you take advantage of rails conventions.
I have a business requirement that calls for an end user to be able to login to an e-commerce system with a one-time use password, purchase a course, and then never be able to login again. At the moment the company that is allowing their employees, my client's students, is going to generate that password for them and send me a list of the passwords they are generating.
I do not like the concept but I have yet to come up with a better one that will work for all parties. If something happens mid-purchase they have to go back to the company to get new login credentials.
The ability to purchase a course cannot be open to the public, it has to be through the e-commerce portal, and for the moment there is only one company participating but there will be more in the future. I am seeing this as a total maintenance nightmare.
My question is has anyone run across this before, if you wouldn't mind sharing tell me how you solved it, or point me in a direction that will give me some insight. I have googled the concept to death and have not come up with any bright ideas.
You can't resolve the "problem during purchase" issue yourself - They need to modify their service so that the password is destroyed when the transaction completes.
No matter what you do with regards to the password, once the user is logged in, the password is disabled on their servers. After that, you have no control.
They should either:
Cancel password on transaction completion
Provide you with an API/Web service to allow you to request a new key.
I have the answer for this one and document it here for my own personal OCD completion purposes. I created a login form that allows for a two part key; username is based on company name plus internal company ID(not a guid), paired with a password that is cryptic key, ex: #SCD6-, plus employee id generated by the company. The rub is I don't know what the employee ID is, and only use it because it should be unique although it doesn't matter if it is not, once the user logs in once completes the only marginally secure process then checks out the login is invalid and can never be used again, unless manually unlocked (in case of a duplicate employeeID at some time in the future, which is unlikely). The username and key is emailed to the employees of the target company, which is generated by the target company.If I do have the employeeID in the system which is 50/50 then I can pre-fill the forms out.
The only thing this lock protects is a process and not secure information so I am not too worried about security and it's only real purpose is to keep John Q, from stumbling onto the process and paying money that my client would need to refund later. If it were a secure data process I would not use this method.
My User object that I want to create and store in the datastore has an email, and a username. How do I make sure when creating my User object that another User object doesn't also have either the same email or the same username?
If I just do a query to see if any other users have already used the username or the email, then there could be a race condition.
UPDATE:
The solution I'm currently considering is to use the MemCache to implement a locking mechanism. I would acquire 2 locks before trying to store the User object in the datastore. First a lock that locks based on email, then another that locks based on username.
Since creating new User objects only happens at user registration time, and it's even rarer that two people try to use either the same username or the same email, I think it's okay to take the performance hit of locking.
I'm thinking of using the MemCache locking code that is here: http://appengine-cookbook.appspot.com/recipe/mutex-using-memcache-api/
What do you guys think?
Try storing your User with their email as the key_name. This can be done in one simple step:
MyUser.get_or_insert(email)
Getting your MyUser by an email is also easy:
MyUser.get_by_key_name(email)
See this similar question: add properties to users google app engine
So that solves the problem of two users with the same email. To do the same for usernames, perform the "get users with this username" query and the "insert a user with this username" in a transaction (this is what get_or_insert() does behind the scenes).
You can catch a TransactionFailedError to find cases when another user "takes" that username during your transaction.
You definitely don't want to use a memcache mutex, since that while loop waiting for the lock to free up can spend a lot of your memcache API call quota.
If you use the JPA impl of datastore, you just have to set the annotation
#Column(unique=true)
Field field
This way the db will reject your insert/update.. i guess it's implemented by gdatastore, it's not a big matter for me to give a "technical error" to the user on such a specific case... but anyway you could catch a constraintviolation exception. I guess JDO also have this.
But actually i don't even know if you'r using Python or Java...
In Java as far as i know you can do a select request in a transaction...
About transactions you should also check what is transaction isolation and how it works on GAE...