Documents removed from the public channel are always returned in `_changes`

Mobile Sync Gateway
1

Hi Everyone,

We have been using Sync Gateway and CouchBase Lite for a new development, at first we were assigning all documents to the public channel !. After a while we moved to named channels, using the usual assign and channel functions in the sync function.

When a new user is created and it creates the replication with CouchBase Lite I see that the db in the mobile device has 2500 documents after a fresh login. I found this weird, what is happening is that the mobile makes a request to _changes returning the documents that were in the public channel with the removed flag.
A request using the same user with the active_only flag would return 0 documents. New documents that were not assigned to the public channel do not appear in the results of _changes.

My first question is: Is there a way to stop having this notification for fresh users? I guess the answer here is no, since it is impossible to know if a request to changes comes from a new user or not, and I guess the active_only flag is there for a reason.

My second question is: For security reason, if I put by mistake something sensitive in the public channel and remove it later, its id will be forever returned in the _changes. Is there a way to simply stop that?

We have been using react-native CouchBase Lite 1.3. with Couchbase Sync Gateway/1.4.1(3;ddffd85).

Thank you for your answers.
Bye.

2

By design, replication is expected to return deleted revisions so clients are aware of deletions.

Yes, the active_only flag is intended to exclude deleted documents and documents that user no longer has access to.

You can set the active_only flag as false . Doesn’t that work for you?

A more drastic measure may be for you to purge the document from the sync gateway as well as the from the clients.

Also as an aside , note that if someone has inadvertently added a document to a public channel, chances are that the client already has replicated the document (and for instance, may have already displayed the data to end user) . So if you want to remove all traces of document, you will need logic in the client to determine that it no longer has access to and take appropriate measures. The active_flag helps with that.

1 Like