Ok I have a couple of questions here. First let me give you some background information. I’m starting a project where I have a node.js server running my application and my website running on another normal server. My application will allow multiple users simultaneous connections and updates to the database so Redis seemed like a good fit there because of its speed and atomic functions.
For someone to access my application they have to login with an account. To get an account, they have to signup for one through my website. So my website needs a database, but its not important to have a database like Redis here because it doesn’t need it. Which leads me to my first question:
1. Can Redis even be used without node.js?
It seems like it would be convenient if both of my servers were using the same database to keep track of information. In some cases, they will keep track of the same information (as in user information) and in other cases, they will be keeping track of separate information. So even if the website wouldn’t be taking full advantage of all that Redis has to offer it seems like it would be more convenient. So assuming Redis could be used in this situation that leads to my next question:
2. Since Redis is linked with JavaScript, how would I handle the security from my website users?
What would be stopping my website users from opening firebug or chrome’s inspector and making changes to the database? Maybe if I designed my site with the layout like this: apply.php->update.php->home.php. Where after they submitted their form it would redirect them to the update page where the JavaScript would run and then redirect them after the database updated to the home page. I don’t really know I’m just taking shots in the dark at this point. 🙂
Maybe a better alternative would be to have my node.js application access its own Redis database and also have access to another MySQL database that my website also has access to. Or maybe there is another database that would be better suited for this situation other than Redis. Anyways any direction on this matter would be greatly appreciated. 🙂
What would be stopping my website users from opening firebug or
chrome’s inspector and making changes to the database?
If this is possible, you’ve got some serious redesigning to do. All your authentication should be on the server end of things. Your node server should be validating the request before it takes any action. End users fiddling with javascript should not be able to perform any action they couldnt already do in the web interface.
This has absolutely nothing to do with the database being used. I’d advise you not to even worry about selecting a DB until you’ve worked out the above.
Addendum
In response to Aust’s question below.
But if I wrote my code to have the website connect to Redis, then
that’s when I would run into security issues, yes?
Yes, thats a huge security problem. You shouldnt be writing directly to the database from the web browser. For starters, doing so requires that you’d give out database user/pass to every web client. Rather, have your javascript code talk to another app on your server, and have that app interact with the database. Your intermediary app (aka, app server, web service, middle tier, etc) should authenticate the user and then only allow actions that user is allowed to do. The web client should have no idea that a database even exists.
7