Re:Backend-as-a-service for web apps?
by timfletcher on Wednesday December 28, 2011 @11:57PM
(#3402576)
The problem with webapps using a BAAS intended for mobile apps is the same origin policy. I've yet to find any providers that support Cross-Origin Resource Sharing. This restriction doesn't apply to mobile apps (or Chrome extensions)
[ Parent
| on HN ]
Re:Backend-as-a-service for web apps?
by kainosnoema on Thursday December 29, 2011 @01:14AM
(#3402748)
OAuth 2 + JSONP might be a good solution to the cross-origin issue.
The primary client for an API I'm currently working on is an iOS app, so for the web version of the client, it just made sense to build on top of the same OAuth-authenticated API. Instead of traditional sessions, we store the access token in a cookie and sign each authenticated request just as you would any third-party API.
Re:Backend-as-a-service for web apps?
by davewasmer on Thursday December 29, 2011 @12:02AM
(#3402583)
If it were to operate as simply a REST API, then the service could simply return everything via JSONP to avoid the CORS trap.
Re:Backend-as-a-service for web apps?
by timfletcher on Thursday December 29, 2011 @12:48AM
(#3402698)
JSONP only works for GET requests. It's not 'proper' AJAX. You wouldn't be able to POST, PUT or DELETE.
Re:Backend-as-a-service for web apps?
by mmahemoff on Thursday December 29, 2011 @12:47AM
(#3402695)
JSONP should only be used for public web services. otherwise, any third party website could make privileged calls.
The BaaS architecture is actually a perfect situation for making privileged calls with CORS, because the server is wholly responsible for the user's identity and permissions.