Anyone with a brain cell knows that using a user that isn't root/dbo/etc adds a lot to security and how effective SQL injection attacks can be. I'm wondering if taking that idea a step further is a good idea.
The basic idea is simple. For guest-like actions (viewing) use a 'guest' user on the database which only has the permissions to
select things. For user-like actions (adding/editing), have a 'user' user, which only has the permissions to run
update queries. As well as that, also include a third user with 'admin' like actions, for
NB: This has been simplified to just cover basic CRUD abilities
- Theoretically added security through permission limits.
- Forces the CMS to be secure to prevent impersonation/replay attacks.
- Complicated code within a CMS (which is what I'm thinking about using this feature in).
- Forces the CMS to be secure (which will not always be achievable)
My question is this:
Is there any security benefit to separating out roles and permissions this way, and if so, do the benefits of doing this justify more complicated code to force a user switch depending on an action?
For example's sake, let's just say that the check to see if I switch users is only an if-statement away, and if that statement fails, then the user isn't allowed to do whatever action anyways so the switch doesn't happen in the first place.