如何在base64中编码我的实例ID

Question

I need to encode my faunadb instance's id because I use it in an URL of this type /mission/(id number)/team

I create instance with this:

/* code from functions/todos-create.js */
import faunadb from 'faunadb' /* Import faunaDB sdk */
/* configure faunaDB Client with our secret */
const q = faunadb.query
const client = new faunadb.Client({
  secret: process.env.FAUNADB_SECRET
})

/* export our lambda function as named "handler" export */
exports.handler = (event, context, callback) => {
  /* parse the string body into a useable JS object */


  const eventBody = JSON.stringify(event.body)
  const data = JSON.parse(eventBody)
  const mission = {
    data: JSON.parse(data)
  }
  // {"title":"What I had for breakfast ..","completed":true}
  /* construct the fauna query */
  return client.query(q.Create(q.Ref("classes/missions"), mission))
  .then((response) => {
    console.log("success", response)
    /* Success! return the response with statusCode 200 */
    return callback(null, {
      statusCode: 200,
      body: JSON.stringify(response)
    })
  }).catch((error) => {
    console.log("error", error)
    /* Error! return the error with statusCode 400 */
    return callback(null, {
      statusCode: 400,
      body: JSON.stringify(error)
    })
  })
}

I call this lambda with a function in a service:

  createMission(data) {
    return fetch('/.netlify/functions/mission-create', {
      body: JSON.stringify(data),
      method: 'POST'
    }).then(response => {
      return response.json();
    });
  }

and then I load this at the init of my page with adress '/mission/(id number)/team' :

this._missionService.readById(this.route.snapshot.params.missionId)

with this lambda by a service again:

import faunadb from 'faunadb'

const q = faunadb.query
const client = new faunadb.Client({
  secret: process.env.FAUNADB_SECRET
})

exports.handler = (event, context, callback) => {
  const id = event.path.match(/([^\/]*)\/*$/)[0];
  console.log(`Function 'mission-read' invoked. Read id: ${id}`)
  return client.query(q.Get(q.Ref(q.Class("missions"), id)))
  .then((response) => {
    console.log("success", response)
    return callback(null, {
      statusCode: 200,
      body: JSON.stringify(response)
    })
  }).catch((error) => {
    console.log("error", error)
    return callback(null, {
      statusCode: 400,
      body: JSON.stringify(error)
    })
  })
}

Actually this is not secure because url handling with id number is possible to access all my missions. I want to encode in base64 this id, but I don't know how to do this, I begin in dev and I thought first encrypt id in service and decrypt it in service but someone said me front is not secure, then I want to use base64 in back. Thanks for advice !

Answer 1

The solution to this problem is definitely not to obfuscate the id with base64 ( which will protect nothing ), but instead you need to associate a user id with your sensitive information in the database.

You then can have them authenticate against your auth/data service to establish identity. Then the service will only serve them records that are associated to them.

The tricky part of this solution is writing an auth protocol for your lambda services.