Hacker News new | ask | show | jobs
by merb 3930 days ago
it's not. The Webserver will MOSTLY handle authentication and CORS BEFORE sending requests to Lucense / ES. Everything else is just, dumb. And wasted Resource Power. You could even use Lucene's Query engine, you just need to proxy everything.

User Input -> (CSRF / Auth) from Your Server -> Your Server -> Lucene

Most implementations will do it like that since everything else is unsafe by design, so the article is pointless.