Protect the database login credentials when working with JavaScript

security
web-browser

(Dougi) #1

Nice! I look forward to having a play with this. How would you protect the database login credentials when working with JavaScript though?


Neo4j JavaScript Driver Releases
(Andreas Kollegger) #2

Generally, don't store the credentials.

Browser local-storage is reasonably sandboxed, but of course a person can look through that using dev tools.

On the nodejs side credentials management would be the same as you'd do for any language. If stored to disk, make sure file permissions are limited.


(Dougi) #3

Thanks, that's what I was thinking. Unless I've missed something (I only speed read it) you would need to pass database login credentials when calling a database select, update etc. Would that not mean that you HAVE to store the credentials client side? I'm sure I've missed something.


(Michael Hunger) #4

Only when you create the driver. And you could use a user login form for that. Like in Neo4j Browser

Usually, you'd use the JS driver on the backend in a node.js server though.


(Dougi) #5

Oh, OK. So this is more for back end node.js stuff than as a practical solution for calling a Neo4j database from a web browser session (unless the database credentials are specifically entered via a form as you say). Really great project, thank you guys very much for all your hard work :)


(Ryan Boyd) #6

Note: you could implement a custom authenticator/authorizer which accepts OAuth tokens and maps those to the appropriate Neo4j user/privileges. Then the JavaScript driver can send the OAuth tokens as the "passwords". We do this for the Neo4j Sandbox.

See more info on custom auth plugins here:
https://neo4j.com/docs/developer-manual/current/extending-neo4j/auth-plugins/