In the past, I’ve been taught that database schema is crucial and should not be exposed in any way so that users cannot inject the system and steal something from it. However, most of the cases I’ve heard are all about login functions that a hacker tries to act as another user, to get his/her privilege on the system. I’m not sure if the situation still remains the same when backend database changes to NoSQL.
If the schema is still crucial and should keep secret, should we always use different keys between API response and database? For example, product_name and db_prod_name. And should we always make the structure different between API response and NoSQL database? What will happen if we just directly return the JSON record from the NoSQL database to API?
The topic Is it okay to reveal database’s table names? should be different to me since my question is about NoSQL database, such as AWS DynamoDB and MongoDB. I suppose the defense strategy may be different due to the characteristics between SQL and NoSQL are different.
Continue reading Is it critical that REST API returns exactly the same content as it is in NoSQL database?→