2

I'm developing an ASP.NET Core 7 MVC Web App. I'm using ASP.NET Core Identity library to manage user and role data. I am considering using SQLite for keeping Identity information, separate from my actual database which is a PostgreSQL database. I want to know how possible it is for this SQLite database to be leaked/attacked, and what precautions I could take to mitigate risks.

The reasons I would like to separate Identity data from my actual database are;

  • I would like to keep things tidy. I like the idea of encapsulating Identity data in its own database, separate from all the tables in my actual database.
  • The identity database (if separated as an SQLite database) would be under no real workload, and queries would only involve simple selects and inserts, so keeping it local in the web server would most likely be no big deal in terms of performance (in fact, it might even be faster than using a remote dedicated database server).

Potential Problems;

  • I use Entity Framework Core with code-first approach for data access, and unfortunately, the SQLite provider does not support encryption. I can't set a password on the SQLite database file for it to be encrypted
  • Performance might become an issue (I don't believe it's a real possibility, as my Web App doesn't have that many users)
  • The obvious risk of the SQLite database file somehow getting leaked (?)

Notes:

  • ASP.NET Core Identity hashes the passwords in User table, so even if the data were to be leaked, the passwords probably would still be safe.
6
  • 1
    The SQLite database is equally at risk as any other database, all else being equal. It depends more on how you configure the server to expose the DB than the type of db used.
    – schroeder
    Commented Feb 22, 2023 at 19:44
  • And as always, what do you want to be secure against?
    – schroeder
    Commented Feb 22, 2023 at 19:45
  • Welcome to the community. In other words, please define your threat model. Commented Feb 22, 2023 at 20:20
  • I am unable to state what exact "attack" I'm trying to secure against. I understand my question is vague, but I'm looking for any suggestions or advises for my situation which is "using ASP.NET Core Identity with SQLite for Identity Storage". I would also love to hear how SQLite would compare to using a local PostgreSQL database for the purpose of Identity storage. How the Identity DB is exposed is completely handled by ASP.NET Core Identity library (including the UI/Views).
    – Emre Bener
    Commented Feb 23, 2023 at 10:58
  • of course, I will be customizing the Identity UI pages' look etc. but I will only do minimal customization to the actual code of the Identity library. I believe all I'll really do in terms of Identity customization is extending the User and Role classes to add my own custom fields. In other words, I completely rely on Microsoft's Identity library, and I would like to hear opinions of people who are knoeledgeable in the field of security on whether it's a good idea or not to use SQLite for Identity storage (in terms of safety).
    – Emre Bener
    Commented Feb 23, 2023 at 11:07

0

You must log in to answer this question.

Browse other questions tagged .