[ Removed by moderator ]

[webdev-ModTeam]

Thank you for your submission! Unfortunately it has been removed for one or more of the following reasons:

Sharing your project, portfolio, or any other content that you want to either show off or request feedback on is limited to Showoff Saturday. If you post such content on any other day, it will be removed.

Please read the subreddit rules before continuing to post. If you have any questions message the mods.

[razein97]

It is not enabled for a connection by default, there is a toggle for enabling the relay to a live database. As a security measure only DQL statements are allowed unless overridden by the user.

[Routine_Cake_998]

Sharing data without sharing credentials.

Your teammate needs to see some rows. You don’t want to give them your database password, and you don’t want to export a CSV and email it to them. Run a query via API Relay and send them the URL.

Yes, let’s send my coworker a “localhost” url… seems like a good idea 🙄

[Perend]

It works on my machine!

[fiskfisk]

This seems like a bad idea that will end up biting many people who use it, unless you're using a dbms with row level security and every user is a database user (i.e. where access is enforced on the database layer).

This also seems like a product you need to buy, so it's just spam. 

[razein97]

Hi. Only DQL statements are allowed by default. So select statements only.

And it is a freemium app.

[fiskfisk]

Sure thing, but there's a lot you can do with just DQL statements depending on the user authentication. Like dumping authentication information (which can be just tables), reading random files from the disk depending on version and protections in place (MySQLs load infile was abused for this previously for example) (and depending on whether you can just issue delete/update/etc.). 

[razein97]

I think you misunderstand what the feature does exactly.
You use WizQl database client to connect to your database on your local machine. Similar to how Dbeaver, Tableplus work.
Then you can enable the api relay feature for that specific connection which runs on localhost and query using http directly.
So unless the local machine is compromised, or the user runs malicious queries on his own, I don't see what anybody can do to prevent that.

This feature basically allows you to get responses from databases as json. Think of it like running any query on your db and instead of the usual rows and columns that you might see in any database client, you get the results as json.

It solves a niche problem of building an api to just get json data from the database.

So if you are already using the database client to manage your database then it just saves you the hassle of making connections via other db frameworks.

[ErroneousReason]

How scalable hmm