apache / apache/pouchdb

Update `pouchdb-adapter-http` to support session authentication instead of basic authentication

Open
#8,935 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
17.6k
Forks
1.5k
PR merge metrics
No merged PRs in 30d

Description

### Issue
Best practices for hashing passwords is to use the highest number of iterations possible. In CouchDb, the recommended number of iterations is 10000, with this disclaimer:
> A higher number provides better hash durability, but comes at a cost in performance for each request that requires authentication. When using hundreds of thousands of iterations, use session cookies, or the performance hit will be huge.
[Source](https://docs.couchdb.org/en/stable/config/auth.html#chttpd_auth/iterations)

`pouchdb-adapter-http` uses basic authentication exclusively.

I'm proposing to update `pouchdb-adapter-http` so that it supports using session authentication, along with basic authentication.

Contributor guide

Open the contributing guide

Research direction

Start by locating the `pouchdb-adapter-http` package and reviewing its existing basic-authentication behavior alongside the CouchDB session-authentication documentation linked in the issue. Done means the adapter supports session authentication while retaining basic authentication; no specific files or tests are named in the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
authentication, databases
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.