Datomic in the browser

http://ragnard.github.io/2013/08/12/datomic-in-the-browser.html

by brucehauman • 13 years ago

94 12 13 years ago

ragnard.github.io

willvarfar2• 13 years ago

Does this mean exposing the DB server directly to the browser e.g. lan or even internet? This does not sound like a good idea! I must have missed something...

chongli2• 13 years ago

Yes, it does. Dealing with all of the security implications of this -- and there are plenty of tools available to handle it -- are beyond the scope of such a simple article.

lukev2• 13 years ago

No, it doesn't. Not really. The REST server is 'just' another Datomic peer.

Part of the value proposition of Datomic is that what is normally thought of as "the database server" is split into separate processes; the transactor and any number of peers. Peers are safe to put in user-facing applications since if one peer goes down the rest are entirely unaffected.

ianbishop• 13 years ago

It's a query API, no different than any REST API.

willvarfar2• 13 years ago

But how is authentication and authorisation mapped and passed around and shared between the app server cluster and the db cluster?

sehrope• 13 years ago

There was a post a couple weeks ago about an nginx module atop PosgreSQL providing a REST interface[1]. This is a similar idea but for Datomic and using a REST server that comes bundled with it. Compared to the PG ngnix module, this one has proper handling of bind variables built into the REST api. With a loose CORS policy (the "-o '*') this can be used directly in a user's browser via AJAX requests.

There's obviously a lot of security issues to think about here, the primary one is that without authentication anybody that is network accessible to the server can execute anything. As such, I don't see much production use in exposing something like this though it does look like it could be fun to use.

Funny thing for me was when I first saw the headline I thought it was web browser database client for Datomic, which is what our company does[2] (though for other databases; we don't support Datomic yet). It'd be possible to build something similar atop this API and have it run entirely client side though it'd have the same security issues mentioned above (vs our setup where DB access is done authenticated and done server to server).

[1] https://news.ycombinator.com/item?id=6109069

[2] http://www.jackdb.com/

ragge2• 13 years ago

Hi, post author here.

Not all browser based applications are, or need to be exposed to the entire Internet.

If you do want to do that, you obviously need to think about who can access what, but since Datomic provides a HTTP based API, you can use any suitable HTTP based technique to achieve that.

coolsunglasses• 13 years ago

You clearly haven't been following the Node.js (Derby and Meteor) community very closely. They've been exposing raw database APIs (mutation, deletion, insert, the works) since the beginning.

rjknight• 13 years ago

I had assumed that "Datomic in the browser" meant an implementation of Datomic that actually runs in the browser (presumably written in ClojureScript, though not necessarily). In fact, this looks more like "[Accessing] Datomic from the browser".

Aside from that, this does look genuinely interesting. I'd like to see more information about how people are using Datomic - I've evaluated it briefly but never saw a good enough reason to move away from familiar relational databases.

ragge2• 13 years ago

Good point, I blame it on my poor english. "Accessing Datomic from the browser" would have been a more appropriate title.

Datomic in the browser

Related Stories