Timeline for Why can't I just let customers connect directly to my database?
Current License: CC BY-SA 4.0
46 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 11, 2020 at 13:05 | comment | added | mr5 |
"Performance should be way better, since we skip the entire HTTP communication and web app code" how did you come up that directly communicating in the database removes HTTP communication? If this is some sort of embedded database, the question wouldn't still make a valid point since it was talking about HTTP.
|
|
| May 6, 2020 at 3:40 | comment | added | GregJF | First question: HOW does the client connect to the server that hosts the database service That client's will need a DBC driver installed on their computer to make the connection. Remote client that can't be connected via tunnelling connection, then the connection can NOT be successful A remote client can't use DBC driver over http (not compatible) Just to re-interate: Security IS the biggest concern as it guards the data. Software engineering practices create quality software, that guards the data. Data is King! Quality is Queen! The King loves the Queen The Queen loves the King | |
| Apr 22, 2020 at 7:18 | history | rollback | schroeder♦ |
Rollback to Revision 2
|
|
| Apr 22, 2020 at 6:58 | vote | accept | Moritz Friedrich | ||
| Apr 22, 2020 at 6:58 | history | edited | Moritz Friedrich | CC BY-SA 4.0 |
added 255 characters in body; added 2 characters in body
|
| Apr 21, 2020 at 12:11 | history | protected | Rory Alsop♦ | ||
| Apr 20, 2020 at 19:36 | comment | added | GuilleOjeda | The better maintainability gained by using an application layer is usually reason enough. Still, it's good to discuss the security aspects as well. | |
| Apr 20, 2020 at 9:33 | answer | added | usr-local-ΕΨΗΕΛΩΝ | timeline score: 0 | |
| Apr 19, 2020 at 22:59 | answer | added | Thomas W | timeline score: 3 | |
| Apr 19, 2020 at 18:40 | answer | added | Billy | timeline score: 1 | |
| Apr 19, 2020 at 16:21 | answer | added | jo0gbe4bstjb | timeline score: 0 | |
| Apr 19, 2020 at 7:35 | comment | added | Askar Kalykov | Because it's never CRUD, that's why. With time you start writing more and more stored procedures and views, which becomes unmanageable, because this monolith depends on RDBMS, which is optimized for data querying and update, and is a bad replacement for any major language's ecosystem (libs, dev tools, vms, etc). | |
| Apr 19, 2020 at 4:27 | answer | added | New Alexandria | timeline score: 2 | |
| Apr 19, 2020 at 4:01 | answer | added | Jasen | timeline score: 0 | |
| Apr 18, 2020 at 23:59 | answer | added | Vilx- | timeline score: 4 | |
| Apr 18, 2020 at 23:45 | answer | added | Brian B | timeline score: 2 | |
| Apr 18, 2020 at 23:24 | answer | added | jmoreno | timeline score: 2 | |
| Apr 18, 2020 at 22:36 | comment | added | Schwern | GraphQL addresses many of these problems. | |
| Apr 18, 2020 at 22:15 | comment | added | makerofthings7 | Also consider CQRS in place of CRUD. I’m pursuing CQRS because of the different psychological effects it has when talking about data. (Crud this, crud that.. carries an unnecessary weight with it) | |
| Apr 18, 2020 at 22:12 | comment | added | makerofthings7 | In some controlled, trusted environments a “valet key” approach” does allow for partial/scoped access to APIs. Azure Table, based in part on OData, CosmosDB, and others support this as an alternative to OAuth calls by websites and apps. | |
| Apr 18, 2020 at 21:54 | answer | added | Steve Morrison | timeline score: 1 | |
| Apr 18, 2020 at 14:43 | answer | added | Gaius | timeline score: 6 | |
| Apr 18, 2020 at 13:10 | answer | added | O. Jones | timeline score: 8 | |
| Apr 18, 2020 at 10:34 | comment | added | marshal craft | Also I don't know how much sql injections are a thing today, but by having the web server query the data base instead of the client, it reduces the possibility of unpredicted behavior, which some security vulnerabilities take advantage of. The rest api still alows a great degree of user programmability, but while removing the possibility of sql injections. That said I have seen website js which apparently did formulate sql requests. Some sites store client html and code on sql servers, which could be driven by desire to reduce costs or complexity maybe? | |
| Apr 18, 2020 at 10:10 | answer | added | fraxinus | timeline score: 7 | |
| Apr 18, 2020 at 8:52 | answer | added | jl6 | timeline score: 14 | |
| Apr 18, 2020 at 8:48 | answer | added | Sergey Shcherbakov | timeline score: 2 | |
| Apr 18, 2020 at 8:35 | comment | added | marshal craft | I think you are asking a good question. So I get this, SQL <-> https <-> (rest/api)user. I think the issue could be sql does not have the security. Thus the web server can only talk to the unprotected data base. This could also be efficient. | |
| Apr 18, 2020 at 7:36 | comment | added | lurscher | for databases that do not have row-level permissions, you can allow them to access only views that query rows they are allowed to see based on their credentials | |
| Apr 18, 2020 at 2:57 | answer | added | lights0123 | timeline score: 5 | |
| Apr 17, 2020 at 23:58 | answer | added | elsadek | timeline score: 5 | |
| Apr 17, 2020 at 22:57 | answer | added | Lawnmower Man | timeline score: 37 | |
| Apr 17, 2020 at 22:11 | answer | added | poolie | timeline score: 19 | |
| Apr 17, 2020 at 21:39 | answer | added | NPSF3000 | timeline score: 60 | |
| Apr 17, 2020 at 20:45 | history | became hot network question | |||
| Apr 17, 2020 at 15:00 | history | tweeted | twitter.com/StackSecurity/status/1251163528456781824 | ||
| Apr 17, 2020 at 14:50 | answer | added | Kate | timeline score: -2 | |
| Apr 17, 2020 at 14:49 | comment | added | Conor Mancone | Typically that was done via an ODBC connection, so that may be worth a read (although ironically ODBC itself was effectively an application layer between the integrating application and the database, it's just that ODBC would interact directly with the database over the internet) | |
| Apr 17, 2020 at 14:48 | comment | added | Conor Mancone | For reference, there are actually many cases where people do exactly this, although it is much more common in older software. There have been cases where I had to open up direct DB access because that was the only kind of integration that some critical and older business software supported. Usually in that case I wouldn't give full database access, or even access to tables my application used. Instead I kept dedicated tables for the applicaton's consumption that only populated when I needed to send data, and other tables for it to write to which I would check regularly for changes. | |
| Apr 17, 2020 at 14:46 | comment | added | Conor Mancone | Hi Moritz. I've edited your question title to be an actual question. If you don't like my change though you are welcome to roll it back or edit it yourself! | |
| Apr 17, 2020 at 14:46 | history | edited | Conor Mancone | CC BY-SA 4.0 |
edited title
|
| Apr 17, 2020 at 14:11 | answer | added | paj28 | timeline score: 69 | |
| Apr 17, 2020 at 13:46 | comment | added | reed | I'm not sure I understand your question, but I'd say it's a matter of design. Your idea might work in some simple cases, but in more complex applications it would soon become a mess (ugly or infeasible). | |
| Apr 17, 2020 at 13:46 | answer | added | ThoriumBR | timeline score: 143 | |
| Apr 17, 2020 at 13:38 | answer | added | Ariff | timeline score: -1 | |
| Apr 17, 2020 at 12:45 | history | asked | Moritz Friedrich | CC BY-SA 4.0 |