How to Secure CouchDB

Question

CouchDB access as a rest service seems insecure. Anyone can hit the database and delete/add documents once it is exposed.

What strategies are there to secure the CouchDB?

Answer 1

A lot has changed since 2009, so I'm going to throw an answer in here. This answer is drawn from this page on the wiki.

CouchDB has a _users database that serves the purpose of defining users. Here's the gist straight from the wiki:

• An anonymous user can only create a new document.
• An authenticated user can only update their own document.
• A server or database admin can access and update all documents.
• Only server or database admins can create design documents and access views and _all_docs and _changes.

Then, for any given database you can define permissions by name or by role. The way authentication is implemented is through a _session Database. Sending a valid username and password to the _session DB returns an authentication cookie. This is one of several option for CouchDB Authentication. There're a few more options:

• This option is a little old 1.0 was a few months back, we're on 1.2 as of today. But it's still very well outlined.
• And this one from "The Definitive Guide"

Also, depending on which hosting service you might be using, you'll have the option to restrict access to couch over SSL.

Between Node, Couch, and a variety of other technologies that effectively scale horizontally (adding more servers) there's an interesting kind of pressure or incentive being put on developers to make applications that scale well in that manner. But that's a separate issue all together.