title: Security of AngularJS applications
body: <p><em>A disclaimer: I'm not really a <a href="http://github.com/yacoob" rel="nofollow">developer</a>, I just enjoy writing some code every now and then</em> :)</p>
  
  <p>Recently I've learned about AngularJS and browser-side MVC frameworks in general, and decided to play with it. Most of Angular docs don't talk in details about server-side of things, leaving this as free choice for the user. After reading up on Angular's <code>$resource</code> service, I've learned about DBs like MongoDB and CouchDB that expose a RESTful interface on their own. Which brought an obvious question - how do you secure those kind of things?</p>
  
  <p>In a "traditional" web application, there'd be a layer on the server side tasked with authenticating users and authorizing their access to the data. Once that's done, server-side code would talk to underlying data store (an RDBMS for example) using fixed set of credentials (identical, regardless of webapp user identity). I can of course replicate this model and write some CRUD code that will expose a REST interface and behave similarly. If I want to use <code>$resource</code>, do I need to tie webapp users to some <em>db</em> users? I can't use a common set of credentials, as they'd be visible in the code - looks like it's writing an intermediate layer, or tying one set of users to another.</p>
  
  <p>I'm curious how this problem is usually solved - as you can see, I have some ideas. Due to my lack of experience I'm just curious about best practices here :) In a general sense, this can be a bit wider question: given that you're not supposed to trust client side running code, how do you deal with things like form validation and other "authorization"-like logic? </p>
  
  <p><strong>tl;dr</strong>: How do you secure RESTful db access? How do you secure your application logic?</p>