I read in the appwrite realtime docs that there is no support for real-time on the server side at the moment. But I need a way to proxy realtime connections for my use ise case.
Basically, I'm looking to use an external Auth service, and the server side APIs to do custom authentication for the endpoints from the client (by disabling direct client side access to the appwrite servics). But for realtime, that doesn't seem to be feasible since it's not possible to connect to the realtime endpoint via API keys. What can I do in this case?
Summary
The user wants to know how to proxy a client's realtime connection in Appwrite. It is mentioned that using the realtime API won't work in this case. The suggestion is to set up websockets and use webhooks to push data through the websocket. The user is using custom code for permission checks and authentication. The concern is raised about restricting access to certain resources client-side. The user mentions using Appwrite Functions or Webhooks for server-side operations. It is mentioned that there is currently no support for real-time on the server side in Appwrite. The user is looking for a solution to proxy realtime connections for their use case. However
Drake
Jun 23, 2023, 18:04
i'm not sure if you can actually use the realtime api if you're not using appwrite's authentication 🧐 how would you restrict access to certain resources client side?
For server-side, we usually use Appwrite Functions or Webhooks
Abdulramon Jemil
Rank 3: Container
Jun 25, 2023, 06:15
All of the restrictions are done in custom code. All of the appwrite endpoints are proxied, and client side access is disabled for the services. To access any resource on the client, the client reaches out to the proxy which uses API keys to access the resource on the server directly and it does authentication as needed.
That's how it works
Abdulramon Jemil
Rank 3: Container
Jun 25, 2023, 06:23
I'm still using Appwrite format though. The Permission and Role objects are still used to generate permissions, and the $permissions property is what's read to determine access rights.
Abdulramon Jemil
Rank 3: Container
Jun 25, 2023, 06:24
But I do understand that while this works fine for other APIs, doing the same with realtime might not be ideal. So,...
Drake
Jun 25, 2023, 08:02
Permissions are ignored when using API key though 🧐
Abdulramon Jemil
Rank 3: Container
Jun 25, 2023, 08:02
Yes I know
Abdulramon Jemil
Rank 3: Container
Jun 25, 2023, 08:03
And that's what I'm taking advantage of
Abdulramon Jemil
Rank 3: Container
Jun 25, 2023, 08:03
I'm doing the permission check myself and return 401 error when needed, else I'll fetch the resource and send to the client
Drake
Jun 25, 2023, 08:03
Ya so since you're doing everything yourself server-side, you won't be able to use our realtime API. You'd have to set up your own websockets and then maybe you can use webhooks to get notified of when to push data through your websocket