search

fullscale / elastic.js

A JavaScript implementation of the elasticsearch Query DSL
http://docs.fullscale.co/elasticjs/
MIT License
654 stars 163 forks source link

Using elastic.js on a non-localhost server #15

Closed Siraris closed 11 years ago

Siraris commented 11 years ago

Hi guys,

I appreciate all the hard work that you put into elastic.js, but I'm a bit lost on how this could ever be used for a public facing application. I have ES running on an Amazon EC2 instance and it's currently sitting behind a nginx proxy. From what I can tell, if I run a search (using request.doSearch()) on ES using Elastic.js, it tries to POST the search request to ES. I'm curious why a post is being executed in order to retrieve data from the ES instance as opposed to a GET. If I was to use your service in a public application, I would have to allow anyone using it to be able to POST to my server, leaving me open to potential security issues.

Can anyone explain this thought process to me? I've been spending the past day or two trying to wrap my head around all this, and getting my proxy to the place where I want it so that I can securely interact with ES over AJAX.

It also might be nice to include some examples in the future on how to interact with a public instance using elastic.js

Thanks!

mattweber commented 11 years ago

We use POST because not all clients can send a request body (the json request) during GET requests. This is pretty standard and the reason elasticsearch supports both.

Securing a public facing elasticsearch server really has nothing to do with this project and would be the same using any ES client (ruby, python, pure rest, etc). It sounds like you are heading down the right path with nginx proxying your requests. You can use nginx to proxy only requests that match certain url's and http methods. This would be more than enough to secure an application assuming you are not blindly proxying all incoming requests back to elasticsearch.

Another option is using something like the ruby proxy Karel wrote in this blog post: http://www.elasticsearch.org/tutorials/javascript-web-applications-and-elasticsearch/

In the future, the FullScale Labs team will be providing more information on securing elasticsearch using OAuth2 with full index level ACL's as well.

aerique commented 11 years ago

Hi Matt, I understand your reasoning but I'm still wondering whether you would accept a patch to make Request.js/doSearch do requests with either POST (by default) or GET (either by using a function argument or setting a value on object instantiation).

My reasoning is that doing GETs to Elasticsearch when all one needs is read-only access is more robust than having people fool around with filters, regexps etc. in their proxies.

BTW This is an issue I'm having at work where I have control over the clients.