Home/ Questions/Q 7932505
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-03T21:02:38+00:00

This is almost certainly a stupid question, but I want to be safe and

  • 0

This is almost certainly a stupid question, but I want to be safe and so I think its always worth double-checking.

As long as I have proper authentication (in my case cookie-based on a 1 database to 1 user basis), then is there any risk in exposing full document contents (i.e. including _id and _rev) in every single GET/PUT relating that document?

By this I mean, is there any conceivable way that providing the whole document, rather than just it’s core data could result in updates being more easily tampered with?

The only way around exposing the _rev to the client, would be to do a HEAD request [server-side] before each PUT in order to get the latest revision number – which seems like madness!

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    There is no way that providing the whole document could result in updates being more easily tampered with.

    If you are using per-database security, then you have a perfect foundation.

    The primary policy that enforces read security is the _security object. The primary policy that enforces write security is the validate_doc_update function.

    So I think the _id and _rev will not factor into a security assessment of your application.

    • 0