How to do backendless mode?

[notramo]

The backendless mode docs says it's not supported, but EdgeDB 2.0 is released, and it has access control built-in.
https://www.edgedb.com/docs/clients/graphql/index#backendless-mode

How to use it?

[raddevon]

Use access policies. Take a look at the examples in our access policies documentation.

[notramo]

I know about this feature, but it lacks some information. E.g. the example uses an user ID for restricting access, but if the client provides user ID, a UUID is not secure enough.
What are the best practices?

[raddevon]

Gotcha. It doesn't require a traditional backend, but it will require something to add your globals to your queries. One of our engineers put together an example that might be helpful: https://github.com/edgedb/edgedb-examples/tree/main/flask-proxy

You'll need an authentication service that signs tokens and a proxy service that proxies queries over HTTP and injects globals based on the tokens. Those globals will hit your access policies to determine whether a user has access to an object.

[notramo]

Is it a good practice to create an authentication server, which authenticates, then stores session tokens for each user in the db, then the client would connect directly to the db, send the session token as global, and the ACL would use that token?

[raddevon]

I think this might not be the best approach. You could run into problems if your tokens are not signed. I'm not a security/authentication expert, but I think this could open you up to a replay attack (an attacker intercepts and re-uses a valid token), possibly among other things.

Not 100% sure that example mitigates for this, but I'm guessing it would since it relies on a GitHub as the authentication service.