I have registrations in a registration db in CouchDB. During registration, the user creates a 'login' password and a hash of that password (the passKey) gets stored in the registration db. When a request comes in, it has the user's passKey in it. I compare that user's passKey to the registration passKey before passing the request along to CouchDB on my db server. The CouchDB request has the db's username/password in it, so there is a second authentication there.
The reason I have this extra layer of authentication in Node.js and am using a proxy server at all has to do with the recommendations that I have from my HIPAA security consultant. He said that although HIPAA does not require it, opening a port to CouchDB on my db server would violate a 'best practice' in HIPAA architecture. If I need to, I can eliminate the extra authentication in the CouchDB requests because they have already authenticated with the passKey at login. But the extra layer of authentication makes me feel more secure. On Thursday, March 6, 2014 9:58:49 AM UTC-8, Alan McKean wrote: > > I'm working on setting up a proxy server in Node.js that accepts the > incoming replication request and proxies it to the target CouchDB database. > I have two tiers of authentication. After getting the incoming request in > the Node.js proxy server, I want to authenticate the user by comparing > their login passKey with what I have on record. Is there a way to configure > the replication pull and push requests to send that first-tier passKey in > the body? The second tier of authentication is in the CouchDB username and > password that CouchDB handles. I suppose I could hack it by concatenating > the two usernames and passwords and parsing them in the Node.js server, but > I was hoping for a better way. > -- You received this message because you are subscribed to the Google Groups "Couchbase Mobile" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/mobile-couchbase/1239a701-8837-4627-be70-e04441f742e6%40googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
