0

I am using neo4j and am considering to query the db directly from the frontend, using the APIs via HTTP.

Usually, I had a different approach and kept the backend to connect to the neo4j driver, format the results and expose them to API endpoints, and the frontend to only fetch those results.

I wonder if I could skip the formatting part by querying directly the database from the client, like: https://neo4j.com/docs/javascript-manual/current/client-applications/#js-driver-configuration-examples or : How to query neo4j graph with jQuery or other users wondering about security aspects with javascript querying directly the db: https://github.com/neo4j-contrib/neovis.js/issues/245

Since my use case is an application for internal use, I am considering that APIs endpoints do not necessarily need to be exposed (there are not third parties querying those endpoints) and I could eventually factor them out (not sure if this is a good practice) and code the necessary queries in the javascript scripts of the frontend.

The neo4j example shows (in this case for nodejs):

const driver = neo4j.driver(uri, neo4j.auth.basic(user, password))

but the same applies to other web clients libraries for neo: https://github.com/neo4j-contrib/neovis.js/issues/245

My concern is sending the credentials for accessing to the db: I don't want to store it on the javascript file...

  • Which is a preferred method to query directly the db from the client, but keeping the connection secure ?
  • are there other issues, like CORS, I should take into account, compared to expose the api in endpoints as: /apis/ on the same domain ? As example, I am using python flask and wonder if I can avoid to serve the frontend files from it.
Improve this question
4
  • I took a look at the docs and while there's a JS driver, it's for nodeJS. I.e. the backend. Which renders this question moot. Commented Apr 28, 2022 at 9:40
  • oh! I was misled from the word "client". I thought it referred to script in the web client. I will edit the question, it is still relevant since it is possible to query the db directly via http as shown in other libraries client. Just wonder how to handle the security aspect and other considerations int the question. Commented Apr 28, 2022 at 9:46
  • This should help: neo4j.com/docs/api/javascript-driver/current Commented Apr 28, 2022 at 10:55
  • Hi @ChrisG, indeed there's the part ``` var driver = neo4j.driver( 'neo4j://localhost', neo4j.auth.basic('neo4j', 'password') )``` but how should i deal with the security aspect? I don't want to store the password on the script. Commented Apr 28, 2022 at 13:31
Related questions
8
Neo4J webadmin with password protection
0
Easy user authentication for Node.Js
0
How to use transactional Cypher HTTP endpoint and new REST API Authentication and Authorization in Neo4j 2.2.x with JQuery
Load 7 more related questions Show fewer related questions

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.