Multi index search

[royduin]

It would be nice if the data search component could search in multiple indices so it's possible to search for products, categories and pages at once. For example: https://magento2.algolia.com, try the autocomplete. Any plans for this?

[siddharthlatest]

@royduin This is a great idea. We just added support for it in the latest release: 3.19.0, using the index prop. (It currently requires use of appbase.io service along with Elasticsearch as it relies on BE query generation. )

[royduin]

With a reverse proxy for SSL and a service like Cloudflare in front of it or with a hosted Elasticsearch service it doesn't have to be an issue. With xpack security it's possible to give users the proper rights and access.

[siddharthlatest]

@royduin Here's a scenario that gets missed:

A developer is using ReactiveSearch to power their search app.

Now what the ReactiveSearch powered search app does today is to run a DSL against the Elasticsearch cluster. Any user can inspect the network tab and create a cURL request to run expensive search queries, e.g. anything aggregation heavy or one which fetches a huge number of hits. (Even if the developer has TLS + CF enabled and are using X-Pack, nothing prevents the above from happening)

The key issue is the exposure of the very powerful query DSL directly within FE. As a reference, if a user can run arbitrary SQL queries against a database, it is considered a serious security vulnerability: https://www.w3schools.com/sql/sql_injection.asp.

---

The solution here is two-fold:

• ReactiveSearch should only send declarative inputs, not DSL queries
• For cases where custom queries need to be extended, users can whitelist the queries (and parameterize) and then pass the inputs from ReactiveSearch (i.e. FE client)

This effectively addresses this attack vector. For other vectors, something like CF is good for DDoS and X Pack or similar alternatives can provide a good role-based access control policy.

[royduin]

I know but there is currently no free alternative so if we implement multi index searches in Rapidez we're forcing users to a paid solution. Don't get me wrong; I like Appbase but as an open source project we cannot force users.

So for now the only thing we can do is securing Elasticsearch the best we can; SSL, Cloudflare, X-Pack with a read only user, lowering max_result_window and keeping an eye on any possible abuse by monitoring.

Any ETA on the server-side component?

[siddharthlatest]

@royduin

We now have the code for server-side query component public over here: https://github.com/appbaseio/reactivesearch-api. It should be released in the next few weeks, we're working on the site and docs related content changes for this.

[royduin]

Nice! Watching the repo 😎