Popular posts

Thanks for the reply, Mark.

To further clarify, the database itself is cloud-hosted. What the database server does is access that data then returns to the API server.

For example, for a simple blogging system (JS), with a normal monolith, one might do:

router.get('/posts', (req, res) => {
  // get user from DB
  const user = db.users.find(req.token.id);
  // get posts from DB
  const posts = db.posts.find(user.id);
  res.json(posts);
});

for a database-server - api-server pair:

DB server

function getUserWithID(id) {
  return db.users.find(id);
}

function getPostsWithUserID(userID) {
  return db.posts.find(userID);
}

API server

router.get('/posts', (req, res) => {
  const user = getUserWithID(req.token.id);
  const posts = getPostsWithUserID(user.id);
  res.json(posts);
});

This way only the DB server has direct access to the DB, while the API server can only access the DB through pre-defined functions. So, an attacker on the API server cannot, for example, drop all posts.

Do you see any advantages/limitations to doing this?