Backend processing for site security.

Ask the community
,
1

Hi, wixers.

After all, should all operations involving collection access be done in the backend for security reasons?

2

There are 2 ways you can address security with your collections. One is by setting the collection permissions to the most restrictive possible for your requirements and secondly yes, you can create any functions to manipulate data in your backend files. Keep in mind that is you are importing backend files to the page code to be called from the page, that you should also set the permissions of the functions in your modules based on who should be allowed to call the function.

See these articles for more information:
https://support.wix.com/en/article/velo-about-web-module-permissions
https://support.wix.com/en/article/collection-permissions-an-overview

3

Thank you for your reply, Amanda.:smile:
I think I already know most of things about backend processing merit and importance of collection’s permissions settings.

But if so, does that mean the benefit of accessing to collection from the public side is … zero? Does it mean that everything is inferior to processing on the backend side and returning only the processed results data to public side?

import wixData from 'wix-data';

wixData.query("myCollection")
  .find() // get all data in this collection.
  .then((results) => {
    if(results.items.length > 0) {
      let items = results.items;
      //↑ this items array contains lots of   
      //and various information.
      //Could this data be illegally
      //obtained by a malicious viewer?  
    }
  })
  .catch((err) => {
    console.log(err);
  });
4

Personally I do not put data operations in front end code, but if you are saying that there is no danger at all for someone to access your query from the front end , (non-confidential, permissions set appropriately) than you can hook it up this way.

It is also important to think about scale. Processing large amounts of data on the client side may not be ideal for your application.

This is really a question of considering your requirements now and in the future and architecting your approach based on that.

Something you may want to check out is a session hosted by one of our server developers about Wix data best practices

5

Your code snippet didn’t load prior to my last reply. Yes, if that code is on the page (client side), anyone can see what is in that array.

6

Thank you very much Amanda.:grin:

From now on personally I’ll do like you.

I’ll double check my codes that all collection related functions are done on the backend side. Also, thank you for sharing such a useful video!!