Obscure username and password in PouchDB

Question

I'm experimenting with PouchDB and client-side Javascript. The example on the PouchDB site works great for me: http://pouchdb.com/getting-started.html. My question is, is there any way to obscure the username and password when I connect to the remote server? The code in question:

var remoteCouch = 'http://user:[email protected]/todos';

This is all client-side JS and publicly viewable. I'm stumped on figuring out a way around it.

Answer 1

When you're communicating between servers you can use SSL to remain secure. The client and server establish a secure connection before sending any data about the request (i.e. the file name, the basic authentication creds, etc.).

As far as what lives on the client side, it's more of a question of how secure do you want to be. Since everything is JavaScript, especially so with PouchDB, you have to settle for one of two things

1. Having a fancy switch that shows you menus or hides menus

   In this scenario you have a main screen with all the important menus. The user either supplies the right password, which takes them to that screen, or the program says "Error incorrect username or password". But since it's all in JavaScript, anyone with enough knowledge of your system could say something like MyApp.User.isLoggedIn = function() { return true; };.

2. Encrypt what you need

   If there is sensitive data on the client side, you can ask them to supply their password and encrypt the sensitive data using that password. Depending on the payload, it may or may not be too performance intensive. You might have to implement your own sessions in this case so you don't end up keeping that password or sensitive data around in memory. Then all Eve would have to do is go to the JS console and hit console.log(MyApp.User.password);. Even though the password is hashed and salted (or should be), Eve likely still has access to the hash function and salt.

Good luck! Would love to hear what you come up with.

Answer 2

If the username and password are to be provided by the user, you can present them with a login prompt and use a secure CouchDB session cookie. The cookie is tamper-proof and will be deleted when the browser session ends or you explicitly delete it.