pouchdb-community / pouchdb-authentication

User authentication plugin for PouchDB and CouchDB.

PouchDB Authentication

Easy user authentication for PouchDB/CouchDB.

var db = new PouchDB('http://mysite:5984/mydb', {skip_setup: true});
db.logIn('batman', 'brucewayne').then(function (batman) {
  console.log("I'm Batman.");
  return db.logOut();
});

Overview

You know what's hard? Security. You know what makes security really easy? CouchDB.

That's right, CouchDB is more than a database: it's also a RESTful web server with a built-in authentication framework. And it boasts some top-notch security features:

• salts and hashes passwords automatically with PBKDF2
• stores a cookie in the browser
• refreshes the cookie every 10 minutes (default)

And best of all, CouchDB does it with good ol'-fashioned HTTP. Just open up the network tab and watch the JSON fly back and forth.

To get started, just install CouchDB, throw in a little SSL, and you've got everything you need for your site's authentication.

Project status

This plugin uses vanilla CouchDB. The goal is to give you a lightweight authentication API that doesn't require anything fancy – no additional server daemons, no third-party providers, just straight-up Pouch and Couch.

So this is more of a reference implementation than an all-in-one solution. If there's a feature missing that you need, you will probably need to write a custom server (see the CouchDB Authentication recipes section for details).

Since version 1.0.0, this plugin does support Node.js.

Using PouchDB Authentication

• Setup
• API
• CouchDB Authentication recipes

Changelog

PouchDB Authentication follows semantic versioning. To see a changelog with all PouchDB Authentication releases, check out the Github releases page.

Contributing

We use standard-version for release versioning along with Angular-style commit messages to automate the changelog generation. To help you make good commit messages, you are advised to install and use commitizen.

PouchDB Authentication is heavily tested, so you'll also want to check out the testing guide.

Big Thanks

Cross-browser Testing Platform and Open Source <3 Provided by Sauce Labs.

pouchdb-authentication's Issues

can't create new DB after logging in

this issue is kind of difficult to describe and I'm not entirely sure if it's related to pouchdb directly or not, but once I login I attempt to create a new database (remote DB) and it fails saying "You are not a server admin.". Now I had this same example working before with a past version of pouch and pouchdb-authentication, I'm not sure why I'm getting such error now, I shouldn't be an admin to be able to create a new DB right? What I'm trying to do is to login and then create a new DB to be used by such logged in user (persist user-specific preferences in such DB), should I check something in my DB before attempting to do this? I get the same error using couch or pouchdb-server.

Get an unknown error when trying to login db

Hi,

I set up couchdb follow your document and it always work well, but recently when I test my app on iPhone I got a error:
{"status":500,"name":"unknown_error","message":"Database encountered an unknown error Unknown error! Did you remember to enable CORS?"}.

I use angularjs $q.all() to get all data from 4 databases, 3 succeeded and 1 failed with the error above, every time the result remained same, but my code is all the same.

this.updateProject = function(projname, username, password) {
        console.log('[pouchService]: updateProject ' + projname);
        var service = this;
        var db = new PouchDB(host + projname, {
            auth: {
                username: username,
                password: password
            }
        });
        return db.login(username, password).then(function() {
            //login project db
            console.log('[pouchService]: ' + username + ' login ' + projname);
            return db.allDocs({
                include_docs: true
            });
        }).then(function(res) {
            //fetch project data
            var doc, data = [];
            for (var i = 0; i < res.rows.length; i++) {
                if ('doc' == res.rows[i].id) {
                    doc = res.rows[i].doc;
                } else {
                    data.push(res.rows[i].doc);
                }
            };
            console.log('[pouchService]: ' + 'fetching project data form ' + doc.id);
            doc.data = data;
            service.clientData.projects[doc.id] = doc;
            db.logout();
            console.log('[pouchService]: ' + 'log out ' + res.name);
            return service.updateProjectBillboard(projname, username, password);
        }).catch(function(err) {
            console.log('[pouchService]: ' + err);
        });
    };

    this.updateProjects = function(username, password) {
        console.log('[pouchService]: updateProjects');
        console.log('[pouchService]: ' + 'logging in ' + username);
        var service = this;
        service.clientdb = new PouchDB(host + username, {
            auth: {
                username: username,
                password: password
            }
        });
        return service.clientdb.login(username, password).then(function() {
            //log in client db
            console.log('[pouchService]: ' + username + ' login ' + username);
            console.log('[pouchService]: ' + 'fetching project list');
            return service.clientdb.get('doc');
        }).then(function(doc) {
            Push.setTags(doc.projects);
            service.clientData.projectIDs = doc.projects;
            service.clientData.projects = {};
            var projects = [];
            for (var i = 0; i < doc.projects.length; i++) {
                projects[i] = service.updateProject(doc.projects[i], username, password);
            }
            return $q.all(projects);
        }).then(function() {
            //sort projects
            console.log('[pouchService]: ' + 'all project data fetched');
            for (var i in service.clientData.projects) {
                service.clientData.projects[i].milestones.sort(service.datedsc);
            }
            service.clientdb.logout();
            console.log('[pouchService]: ' + 'log out ' + username);
        }).catch(function(err) {
            console.log('[pouchService]: ' + err);
        });
    };

my log is
2015-06-10 13:17:39.433 pm[6838:4964870] [pouchService]: updateProject proj001
2015-06-10 13:17:39.433 pm[6838:4964870] [pouchService]: updateProject proj002
2015-06-10 13:17:39.434 pm[6838:4964870] [pouchService]: updateProject proj003
2015-06-10 13:17:39.434 pm[6838:4964870] [pouchService]: updateProject proj004
2015-06-10 13:17:39.556 pm[6838:4964870] [pouchService]: yy login proj001
2015-06-10 13:17:39.557 pm[6838:4964870] [pouchService]: {"status":500,"name":"unknown_error","message":"Database encountered an unknown error Unknown error! Did you remember to enable CORS?"}
2015-06-10 13:17:39.630 pm[6838:4964870] [pouchService]: yy login proj002
2015-06-10 13:17:39.704 pm[6838:4964870] [pouchService]: yy login proj003
2015-06-10 13:17:39.704 pm[6838:4964870] [pouchService]: fetching project data form proj001
2015-06-10 13:17:39.705 pm[6838:4964870] [pouchService]: log out undefined
2015-06-10 13:17:39.705 pm[6838:4964870] [pouchService]: updateProjectBillboard proj001
2015-06-10 13:17:39.888 pm[6838:4964870] [pouchService]: fetching project data form proj003
2015-06-10 13:17:39.889 pm[6838:4964870] [pouchService]: log out undefined
2015-06-10 13:17:39.889 pm[6838:4964870] [pouchService]: updateProjectBillboard proj003
2015-06-10 13:17:39.890 pm[6838:4964870] [pouchService]: fetching project data form proj002
2015-06-10 13:17:39.890 pm[6838:4964870] [pouchService]: log out undefined
2015-06-10 13:17:39.890 pm[6838:4964870] [pouchService]: updateProjectBillboard proj002
2015-06-10 13:17:39.964 pm[6838:4964870] [pouchService]: log out proj001billboard
2015-06-10 13:17:40.163 pm[6838:4964870] [pouchService]: log out proj003billboard
2015-06-10 13:17:40.372 pm[6838:4964870] [pouchService]: log out proj002billboard
2015-06-10 13:17:40.457 pm[6838:4964870] [pouchService]: all project data fetched

Any idea on this? It only happened when test on phone till now, test on chrome works fine.
Thanks!

HTTP auth modal shown when require_valid_user = true

Steps to reproduce

1. A fresh CouchDB instance with the following configuration:

[httpd]
enable_cors = true
require_valid_user = true

[cors]
origins = *
credentials = true
methods = GET, PUT, POST, HEAD, DELETE
headers = accept, authorization, content-type, origin, referer

1. Disable admin party with one admin user: username: admin, password: admin
2. Serve index.html locally (e.g. via python -m SimpleHTTPServer)
3. Open up a new incognito window and browse to it

Expected

An (empty) allDocs result logged to the console.

Actual

A HTTP Basic Auth browser login box is displayed.

Hunch

I suspect what's happening here is var db = new PouchDB('http://localhost:5984/test') is making an initial request before db.login, which is triggering the auth modal.

Indeed, the following seems to work (albeit with a few console errors):

var db = new PouchDB('http://localhost:5984');
// Monkey-patch pouchdb-authentication#getSessionUrl
// return 'http://localhost:5984/_session';
db.login('admin', 'admin')
  .then(function() {
    db = new PouchDB('http://localhost:5984/test');
    return db.allDocs();
  })
  // ...
});

Safari 7 don't allows third-party cookies by default and login doesn't persist

Hi,

I've developed an app under Chrome that runs on a domain and queries a CouchDb hosted at couchappy.com and works good but when I tested it in Safari the login is successful but if I after call getSession, the response says that I'm not logged in.

I've finally discovered that if I allow third party cookies in Safari settings, it works good.

how can i solve this problem?

Thanks

.signup() to create new db admin

can I use this method to create an admin user type?

Offline first and Pouch Auth integration together?

Hello,
I like what you have done with PouchDB, being able to create an app with such an easy api to store all the data is great. Pouch is offline first and it's really great to develop with.

The only way I succeed in making this plugin to work was using this code :

var db1 = new PouchDB("http://localhost:5984/test_db")
db1.getSession().then(function(x)){console.log(x)}
db1.getUser('myUser').then(function(x)){console.log(x)}

It works but I don't have the offline first features I was expected. Is there any way this pouchDB plugin can be use to get the authentication and offline first features working together?
Something that could look like this code ?

var db1 = new PouchDB('db1')
PouchDB.sync('http://localhost:5984/db1', 'db1');
db1.getSession().then(function(x)){console.log(x)}
db1.getUser('myUser').then(function(x)){console.log(x)}

I feel quite stuck with this issues as those two features are important to me. Creating a user document in my main database seems a bad solution.

Any suggestion would be super appreciated.

Missing final semicolon in dist file

It missing semicolon at final line of pouchdb.authentication.js dist file. That create troubles when use grunt concat. Please add this missing semicolon.
Thank you.
Best regard,
Antoine Michéa.

---

UPDATE :
Anyway i self resolve by using grunt conf :
concat: {
options: {
separator: ';',
}
}

Login not returning username for admin

Greetings!

I noticed that, for my admin user, when I login through PouchDB (using this plugin), the "name" field is undefined. But, for other users, it's present.

{
"ok": true,
"name":null,
"roles":["_admin"]
}"

I'm using the last release (0.3.6), as far as I know.

Change Password

It would be nice to have functionality built in to change a password, eg:

db.changePassword()

Its basically just a get _user, set doc.password and put the doc back nowadays (since CouchDB 1.2).

Would you accept a pull request for that?

remove 'dist' folder from .npmignore

preflight problem

when testing your code ( i replaced localhost by my laptop lan ip. I created a db called test and set admin password as admin )

i get this error

having this in couchdb

Can you point where the problem is ?

thank you

login() throwing illegal_database_name error for '_session'

When I try to use the login() method, I am getting an illegal_database_name error for _session. I'm guessing this has something to do with utils.getSessionUrl, which is returning http://54.164.xxx.xxx:xxxx///_session (anonymized). Here is the complete error:

{ [illegal_database_name: Database encountered an unknown error]
  status: 400,
  name: 'illegal_database_name',
  message: 'Database encountered an unknown error',
  error: true,
  reason: 'Name: \'_session\'. Only lowercase characters (a-z), digits (0-9), and any of the characters _, $, (, ), +, -, and / are allowed. Must begin with a letter.' }

I don't see why this is being thrown. Half of the time, I am also getting an { [Error: read ECONNRESET] status: 400 }, but I'm guessing that is just my connection. Any ideas?

TypeError: Object #<PouchDB> has no method 'getUrl'

Is it possible that there used to be a db.getUrl() method, which recently has been removed, but you still use it in this plugin?

TypeError: Object #<PouchDB> has no method 'getUrl'
    at getBaseUrl (.../node_modules/pouchdb-authentication/lib/utils.js:6:13)
    at Object.exports.getSessionUrl (.../node_modules/pouchdb-authentication/lib/utils.js:12:10)
    at PouchDB.<anonymous> (.../node_modules/pouchdb-authentication/lib/index.js:113:19)
    at .../node_modules/pouchdb-authentication/lib/utils.js:65:14
    at tryCatch2 (.../node_modules/pouchdb-authentication/node_modules/pouchdb/node_modules/bluebird/js/main/util.js:73:19)
    at Promise$_resolveFromResolver [as _resolveFromResolver] (.../node_modules/pouchdb-authentication/node_modules/pouchdb/node_modules/bluebird/js/main/promise.js:595:13)
    at new Promise (.../node_modules/pouchdb-authentication/node_modules/pouchdb/node_modules/bluebird/js/main/promise.js:87:37)
    at PouchDB.<anonymous> (.../node_modules/pouchdb-authentication/lib/utils.js:53:19)
    at PouchDB.getSession (.../node_modules/pouchdb-authentication/lib/utils.js:34:16)

Cannot find module 'pouchdb/extras/promise'

f76b449 breaks the library. Offending code:

var Promise = require('pouchdb/extras/promise');

module.js:318
    throw err;
    ^
Error: Cannot find module 'pouchdb/extras/promise'
    at Function.Module._resolveFilename (module.js:316:15)
    at Function.Module._load (module.js:258:25)
    at Module.require (module.js:345:17)
    at require (module.js:364:17)
    at Object.<anonymous> (.../node_modules/pouchdb-authentication/lib/utils.js:3:15)

This assumes that pouchdb installed is the latest version. But this is neither required by the package.json (use a commit-ish suffix), neither makes direct sense as the pouchdb-authentication depends on its own pouchdb, which may be different from the pouchdb my application depends on.
The dependency between pouchdb-authentication and pouchdb is more of a peer dependency, not a direct dependency.

My suggested architecture for plugins is to take the host object as a parameter in the initialization of the plugin. Which versions of the host object are accepted is then part of a public API of the plugin.
Then, if the plugin one day requires a new feature from a new version of the host object, it's a breaking change in the plugin and requires a major version bump.

Integration with hello.js

Would it be possible to integrate this plugin with hello.js?
Hello.js allows you to login to an external service (such as google/facebook/...).

The plugin works like this:

hello("google").login.then(function() {
   //Is it possible to securely login a user here using pouchdb-authentication?
})

Or would this be impossible cause of security reasons?

Unknown error when calling db.signup()

I'm trying to sign up a user, and I'm getting an exception labelled // HTTP error, cosmic rays, etc.. I'm not sure how to deal with this issue, and I don't know why it is called.

The code is here, and I've no idea how to start diagnosing. What do you think?

Cloudant

When trying to login with Cloudant I get the following error:

const remoteDB = new PouchDB('https://foo123.cloudant.com/mydb')
remoteDB.login('fender', 'test123', function(err, response) {
  console.log(err, response)
})

{message: "you must specify application/x-www-form-urlencoded as the primary content-type", status: 400, name: "bad_request"

Creating users worked fine.

Here are the ajax options:

{
    "method": "POST",
    "url": "https://foo123.cloudant.com:/_session",
    "body": {
        "name": "fender",
        "password": "test123"
    }
}

Shouldn't pouchdb be a peerDependency?

..or at least upgraded to 5.x?

[feature request] db.putUser for updating user metadata

We have the db.getUser method and we can create metadata with the db.signup method but there doesn't appear to be a way to update the user doc after its created. I think there'd be a lot of overlap with the signup method.

How does the login work?

Hello,

I'm curious how login method works. How does it keep the session? Or maybe it just sets te cookie and leave the rest to pouch?

Thank you!

fullpath build on dist folder

Hy @nolanlawson

here is the path https://github.com/nolanlawson/pouchdb-authentication/blob/76892a072b0da6c396187648c0c4fadd2780dfd3/dist/pouchdb.authentication.js#L285-L286

i think its because this is not work properly

cheers

anonymous Users

How do you handle anonymous users?

Accessing Cookie after Login

Hey Nolan,

This is more of a question than an issue, but I don't think I can add a label.

I was wondering if there was a way to access the set-cookie header from the login ajax request? Basically, I'd like to be able to then pass the cookie to my api server (for some specific tasks) to confirm against couchdb that the user is logged in.

It would save me having to setup a separate authentication system for the server.

Using Authentication with HTTPS - status 500 error

I am getting a status 500 error when I try to login using the authentication plugin over https on port 6984 from an external IP to my public domain address. I am using a self-signed certificate.

I have CORS set up, but get the following message:

CustomPouchError {status: 500, name: "unknown_error", message: "Database encountered an unknown error Unknown error! Did you remember to enable CORS?", error: true}

I can login if I go directly to the server from within my network using its machine IP address (.ie. 192.168.XXX.XXX).

I have no problem logging in over http on port 5984 over the same public domain.

I can also login to Futon using https at the same public address that fails above - so the SSL certificate works for Couchdb.

I put Pouchdb into debug mode, but I really can't see anything that helps.

Any thoughts where I should look?

Problem with db.login()

I created the following test code:

var user = {
  name: 'user',
  password: 'test'
};

var pouchOpts = {
  skipSetup: true
};

var ajaxOpts = {
  ajax: {
    headers: {
      Authorization: 'Basic ' + window.btoa(user.name + ':' + user.password)
    }
  }
};

var db = new PouchDB('https://pouchdb-auth.iriscouch.com/auth-demo', pouchOpts);
var err;


function userLogIn() {
    db.login(user.name, user.password, ajaxOpts).then(function() {
      return db.allDocs();
    }).then(function(docs) {
      console.log(docs);
    }).catch(function(error) {
      console.error(error);
    });
}

My test HTML file has something like this in it

<button class="btn btn-primary" onclick="userLogIn()">userLogIn()</button><br>

CORS is enabled on IrisCouch (credentials, headers, methods and origins are defined) and require_valid_user = true, because I need the user to login in first before doing anything with my db.

But when I am calling the userLogIn() by pressing the button, I still get the old login windows from the browser. When I enter my credentials, the login works fine. But I'd like to build my own login screen. Shouldn't this be working with ajaxOpts? Or do I have to add anything else / configure something more on IrisCouch?

Thanks for helping me in advance. This is my first project with PouchDB, so I might do something wrong...

Broken in node.js because 'lie' is missing

Node is trying to use the promise library 'lie' but that lib isn't specified as a normal dependency, only as a dev dependency. 'npm install lie' in pouchdb-authentication's directory fixes it, but it would be better if it was just in the package.json file.

The error:

marten@marten-laptop:~/bzr/python-pouchdb/js/python-pouchdb-js$ node index.js 

module.js:340
    throw err;
    ^
Error: Cannot find module 'lie'
    at Function.Module._resolveFilename (module.js:338:15)
    at Function.Module._load (module.js:280:25)
    at Module.require (module.js:364:17)
    at require (module.js:380:17)
    at Object.<anonymous> (/home/marten/bzr/python-pouchdb/js/python-pouchdb-js/node_modules/pouchdb-authentication/utils.js:7:69)
    at Module._compile (module.js:456:26)
    at Object.Module._extensions..js (module.js:474:10)
    at Module.load (module.js:356:32)
    at Function.Module._load (module.js:312:12)
    at Module.require (module.js:364:17)

Offline authentication? Is it possible

Hi,

Just looking at the documentation and its quite clear that the PouchDB instance for authentication must be remote and not local. Is it at all possible for local authentication?

My scenario is consultants working offline in a hospital which need to create new orders and read existing offline data, so they will already be registered and replicated locally. My plan was to use a Chrome packaged app but I am wondering now if I need to go the whole hog and using something like node-webkit or nwjs as its now known.

Thanks

Mark

"skipSetup: true" with "require_valid_user = true" shows browser modal

Hey there,
I set require_valid_user = true in my CouchDB's local.ini,
to only allow actual users, but no anonymous users.

Also skipSetup: true is set when initalizing the DB.

However, each time I db.login('test', 'test'), I get the browser modal requiring to enter credentials,
although test:test exists, and normally works without require_valid_user = true

tested in Firefox 42 and Chrome 47.

the relevant code:

    var db, local
    function switchDB(dbname) {
      db = new PouchDB('http://127.0.0.1:5984/' + dbname, {skipSetup: true})
      local = new PouchDB(dbname)
      local.sync(db, {live: true, retry: true}).on('error', console.log.bind(console))
      return db.login('test', 'test')
    }

I already tried http://stackoverflow.com/questions/32670580/prevent-authentication-popup-401-with-couchdb-pouchdb, which seemed to solve the issue, but I want to use fauxton on the backend which doesn't work after that.

If it doesn't work any other way, I guess I could set roles for each db as a workaround…

AuthSession cookie is empty

Delete it please!

Change Password? Lost Password?

Hi, I'm still figuring this out. I'm trying to build and off-line Chrome App. https://developer.chrome.com/apps/about_apps

I plan to:

• Make a local PouchDB,
• Sync it to a server CouchDB,
• Use pouchdb-authentication
• Have user login with a password (to protect casual messing with their data)

How do I change a user's password? And does that sync back to the server?

How do I reset the user's password if they lose it?

Thanks!

doesn't work in node

fails with ReferenceError: XMLHttpRequest is not defined

changeUsername API

@nolanlawson Would such thing make sense? I have an application where I'm using this plugin and each user identifies with its email. I'd like to be able to give users the possibility to update the email they use to log into the app. If it does, I may be able to submit a PR soon.

Cannot get document after login

Hi,
I am working with pouchdb-authentication in one db per user mode and set up couchdb followed your doc. I come across a problem when I first loading page, I get a 401 error when use db.get after login successful, but if I refresh page, it all works fine. I don't know why, here is my code and log.

pouchService.userdb.allDocs({
                    include_docs: true,
                    attachments: true
                }).then(function(doc) {
                    console.log('[home]: ' + username + ' login ' + 'user');
                    pouchService.clientdb = new PouchDB(host + username);
                    return pouchService.clientdb.login(username, password).then(function() {
                        //log in client db
                        console.log('[home]: ' + username + ' login ' + username);
                        console.log('[home]: ' + 'fetching project list');
                        return pouchService.clientdb.get('doc');
                    })
                }).then(function(doc) {
                    //fetch project list
                    console.log('[home]: ' + 'project list fetched');
                    ...

[home]: yy login user
app.js:287 [home]: logging in yy
172.16.11.223:5984/yy/?_nonce=1431499152129:1 GET http://172.16.11.223:5984/yy/?_nonce=1431499152129 401 (Unauthorized)
app.js:291 [home]: yy login yy
app.js:292 [home]: fetching project list
app.js:333 [home]: {"status":401,"name":"unauthorized","message":"Name or password is incorrect."}
Resource interpreted as Image but transferred with MIME type text/plain: "blob:http%3A//localhost%3A8100/10940aae-8e34-4e24-876e-e80a66bd3f39".

Any idea on how to solve this?
Thanks for your help!

Social authentication

This is more of a question than a bug. Is this plugin designed to work as a social login authentication system? - And how.

Is there some forgot password option

I haven`t found on web how to workaround whit forgot password. Do you know some solution?

editing roles

is it possible to update user roles or metadata? if so how?

Usage with PouchDB only (no CouchDB)

Sample app uses PouchDB on both the client and the server, by using express, pouchdb and express-pouchdb on the server:

https://github.com/bguiz/pouchdb-express-demo/blob/develop/server/index.js#L3-L5

Now in this project, one of the stated requirements is "CouchDB v1.3.0+ or IrisCouch" for the server. Which features of CouchDB that aren't present in PouchDB are necessary? How feasible is it to use the pouchdb-authentication on a set up with PouchDB on the server?

Why force http/https ?

I was wondering why the plugin forces you to authenticate against an online couchdb ?

My app uses a local pouchdb that syncs to Iriscouch - the main reason being that the local db is available when the user is offline (it's inside a Chrome App ... 'Offline First').

What if a user wanted to login to his offline app when there was no internet connection ?

From mongod to pouchdb/couchdb

I want to migrate my app from mongodb to pouchdb/couchdb for the syncing. But I am lost. My app has 20 collections in a mongo database. One collection holds the users, who can only view content they created in the other collections, using their ids. I implemented my own user management system. Now, with 'one database per user', do i have to create 19 databases for each user or put everything into one database?

OAuth2 authentication

Would it be possible to sign up and log in users using OAuth? For example with Google+ or Facebook?

PS: Are you still maintaining this repository because I noticed this repository has more recent commits than the Janus one?

Credentential in plain text ? Is there a way to avoid that ?

Hi,

I'm beginning to work with pouchDB and couchDB, and i'm trying to use your plugin in my app. But there is something that bothers me when i do that :
var user = {
name: 'admin',
password: 'admin'
};

var pouchOpts = {
skipSetup: true
};

var ajaxOpts = {
ajax: {
headers: {
Authorization: 'Basic ' + window.btoa(user.name + ':' + user.password)
}
}
};

var db = new PouchDB('http://localhost:5984/test', pouchOpts);

db.login(user.name, user.password, ajaxOpts).then(function() {
return db.allDocs();
}).then(function(docs) {
console.log(docs);
}).catch(function(error) {
console.error(error);
});

The credentials are in plain text in the request and for me it's a major security issue. Is there a way to avoid that or am i doing it wrong ?

Thx in advance.

Authentication with different PouchDB databases for a single CouchDB instance.

How would this plugin react to the following database scheme:

1 Remote Couchdb instance
3 Remote databases on this Couchdb instance. For example:

• todos
• posts
• comments

Using PouchDB, I would make a new PouchDB database (db) for each database in my remote CouchDB instance. This means I have 3 different PouchDB databases locally:

var tododb = new PouchDB('http://localhost:5984/todos')
var postdb = new PouchDB('http://localhost:5984/posts')
var commentdb = new PouchDB('http://localhost:5984/comments')

However, I do not want my users to login in to each of these databases separately.
If a user of my web app logs in to one of these databases:

var tododb = new PouchDB('http://localhost:5984/todos')
tododb.login('superman', 'clarkkent')

Will the authorization cookie also be send when another PouchDB object (e.g. postdb) makes a query to the remote database? Or do I have to login to postdb separately? (Which actually means loggin in to the same remote couch but letting the local PouchDB object know we logged in)

Because all users are shared across the CouchDB instance, it might be possible to login to the CouchDB instance to make sure the cookie is sent when I access one of the databases of this instance?

var instance = new PouchDB('http://localhost:5984/')
instance.login('superman', 'clarkkent')

authentication is lost when user document is updated

Is it possible a user loses authentication after they perform an update of their own document?

I think this is what is happening in my application:

1. User logs in with his credentials.
2. He updates his own email address stored in his user document. (org.couchdb.user:test)
3. He looses authentication. (?)

Why does this last step happen and is it possible to prevent this from happening? Or do I need to create a new database with the additional user-info aside from roles, paswords etc?

Recommended setting of CouchDB configuration: {couch_httpd_auth: timeout} parameter

Hi!
Is there a recommended setting of the CouchDB configuration: {couch_httpd_auth: timeout} parameter?

The reason for asking is that the default cookie refresh time is 10 minutes in pouchdb-authentication, and without being 100% sure I seem to get problems if I set the timeout parameter to less than 10 minutes.

Best,
Sinan

Update pouchdb

src folder

Is it possible to publish src folder?
Or am I missing something?

Absolute file path in code

I don't know what this exactly is, but it looks wrong to me:

https://github.com/nolanlawson/pouchdb-authentication/blob/master/dist/pouchdb.authentication.js#L285

Status 500 when db.login() on IrishCouch

I am getting an error when I try to login using the authentication plugin : pouchdb-authentification v0.4.1 :
PouchDB error: the remote database does not seem to have CORS enabled. To fix this, please enable CORS.

But I have CORS set up on my IrisCouch databse :

option	value
cors credentials	true
headers	accept, authorization, content-type, origin, referer
methods	GET, PUT, POST, HEAD, DELETE
origins	*

This code works (IrishCouch + local CouchDB) :

fetch(`https://mydatabse.iriscouch.com_session`, {
    method: 'post',
    headers: {
        'Accept': 'application/json',
        'Content-Type': 'application/json'
    },
    body: JSON.stringify({
        name: username,
        password: password
    })
}).then(response => {
   console.log(response);
}).

But not this one with pouchdb-authentification on IrishCouch (this works with a local CouchDB) :

import PouchDB from 'pouchdb';
var db = 'https://mydatabase.iriscouch.com/';
PouchDB.plugin(require('pouchdb-authentication'));
var user = new PouchDB(`${db}_users`);
user.login(username, password).then(response => {
   console.log(response);
}).catch(error => {
   console.log(error); 
});

Return: {status: 500, name: "unknown_error", message: "Database encountered an unknown error Unknown error! Did you remember to enable CORS?", error: true}

UPDATE 3:00 pm : this works only with Firefox :
Return: Object { ok: true, name: "***", roles: Array[1] }

Via curl this works : curl -X POST -i https://mydatabse.iriscouch.com/_session -d name=***@**.com -d password=****, return: {"ok":true,"name":"**@**.com","roles":["**"]}

So, it's not an error on my database I think. Do you know how to fix that ?

Thanks.

Leo

db.getSession not working in IE 11

We are using pouchdb-authentication as authentication process for PouchDB.
Its working great with Firefox and Chrome but not in IE.

For example:

db.getSession(function (err, response) {
        console.log(JSON.stringify(response));
});

Response in Firefox/Chrome:

{"ok":true,"userCtx":{"name":"admin","roles":["admin"]},"info":{"authentication_db":"_users","authentication_handlers":["oauth","cookie","default"],"authenticated":"cookie"}}

Response in IE:

{"ok":true,"userCtx":{"name":null,"roles":[]},"info":{"authentication_db":"_users","authentication_handlers":["oauth","cookie","default"]}}

Is there any specific option for IE we are missing or it needs some configuration over CouchDB?

Signup / login

Hi,

why do you require existence of PouchDB for Signup and Login? The only thing that you need is url of the server. Then you would avoid the '{skipSetup: true}'. I am in the situation where I do not know the database url before I log in. So I have to create dummy PouchDB just to login. Sounds overcomplicated to me.