0

I'm envisaging a website where a user signs up, has their own database running somewhere, then provides credentials to the website so that website can access that database. For example, if I was the user, I might be running MySQL on a shared hosting plan somewhere - I want to join this website and authorise this website to query my database.

I am looking for advice on the security issues I would need to consider (as the website developer, but also the issues the end user would need to consider).

I think securing the website with https is mandatory, but then how should the db credentials be stored? In plain text in the website's own db? How should the website make a connection to the user's db? Would ODBC suffice for most DBMSes? If the website were coded in, say, PHP, would using PHP's native database connection functions be more secure, or better for any other reason? Would the user need to authorise (within their DB) the connection as coming from the website's specific ip address? etc.

I realise this is not a simple programming question with a black and white answer but I'm hoping to be given a list of considerations I should investigate, or perhaps links to articles that discuss these issues.

Thank you in advance.

1

This sounds very risky. You are requiring users to expose their databases to the web so your site can access them?

The risk here is on the database owner and not so much you. All you need to care about is securing credentials and that you support their connection requirements.

They need to

  • Ensure that only your IP can connect into their environment (Exposing their database to the web is awful)
  • Create a restricted privilege account for you to use
  • Create stored procedures for the account to limit what it can do
  • Monitoring for odd behavior connecting to the account
  • Ensuring that connections to the database only allow encrypted sessions
  • Have a plan in place for a breach of their data

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.