Hacker News new | ask | show | jobs
by dalailambda 3365 days ago
A web page, for example, should not have direct access to the database.
1 comments

If an app can't have direct access to the database, why would letting it access via a web api be better?
I can think of a few use cases.

- The developer is writing apps in languages that do not have PostgreSQL drivers. Or the available PostgreSQL drivers have major drawbacks. HTTP libraries are pretty much ubiquitous, and the benefits of using HTTP might outweight the drawbacks of the existing drivers or the drawbacks of using HTTP.

- HTTP as a protocol is very good in the sense that there is a lot of tooling around it for load balancing, proxying, security, etc. Depending on the skill level and distribution in the organization, it may make a lot of sense to use HTTP as a protocol for accessing the database so that certain aspects of security, high availability, etc. can be the responsibility of system administrators, rather than developers who must hack into the database driver.

The two use cases above are not theoretical. Someone invented DBSlayer a decade ago, which is like a PostgREST for MySQL. You can read their rationale here: https://open.blogs.nytimes.com/2007/07/25/introducing-dbslay...

And a third use case:

- The author deliberately wants to expose a public database, as a public learning environment of some sort. No production data is stored in the database.

because the web api (PostgREST) has a strict control on the types of queries the client is allowed to execute thus preventing DOS attack against the db that force it to run complicated/unoptimised joins or function that use a lot of CPU
PostgreSQL has built-in strict control also.
no it does not, it has control of what data a user can access, it has no control of what types of joins he can do using the tables he has access to or what functions he can execute.

For example anyone can do "select md5(bigtextcolumn) from articles" and kill the db if one would expose the entire sql language to the web. PostgREST protects you agains that.