1

I'm developing an ASP.NET Core 7 MVC Web App. I'm using ASP.NET Core Identity library to manage user and role data. I am considering using SQLite for keeping Identity information, separate from my actual database which is a PostgreSQL database. I want to know how possible it is for this SQLite database to be leaked/attacked, and what precautions I could take to mitigate risks.

The reasons I would like to separate Identity data from my actual database are;

  • I would like to keep things tidy. I like the idea of encapsulating Identity data in its own database, separate from all the tables in my actual database.
  • The identity database (if separated as an SQLite database) would be under no real workload, and queries would only involve simple selects and inserts, so keeping it local in the web server would most likely be no big deal in terms of performance (in fact, it might even be faster than using a remote dedicated database server).

Potential Problems;

  • I use Entity Framework Core with code-first approach for data access, and unfortunately, the SQLite provider does not support encryption. I can't set a password on the SQLite database file for it to be encrypted
  • Performance might become an issue (I don't believe it's a real possibility, as my Web App doesn't have that many users)
  • The obvious risk of the SQLite database file somehow getting leaked (?)

Notes:

  • ASP.NET Core Identity hashes the passwords in User table, so even if the data were to be leaked, the passwords probably would still be safe.
6
  • 1
    The SQLite database is equally at risk as any other database, all else being equal. It depends more on how you configure the server to expose the DB than the type of db used.
    – schroeder
    Feb 22, 2023 at 19:44
  • And as always, what do you want to be secure against?
    – schroeder
    Feb 22, 2023 at 19:45
  • Welcome to the community. In other words, please define your threat model. Feb 22, 2023 at 20:20
  • I am unable to state what exact "attack" I'm trying to secure against. I understand my question is vague, but I'm looking for any suggestions or advises for my situation which is "using ASP.NET Core Identity with SQLite for Identity Storage". I would also love to hear how SQLite would compare to using a local PostgreSQL database for the purpose of Identity storage. How the Identity DB is exposed is completely handled by ASP.NET Core Identity library (including the UI/Views).
    – Emre Bener
    Feb 23, 2023 at 10:58
  • of course, I will be customizing the Identity UI pages' look etc. but I will only do minimal customization to the actual code of the Identity library. I believe all I'll really do in terms of Identity customization is extending the User and Role classes to add my own custom fields. In other words, I completely rely on Microsoft's Identity library, and I would like to hear opinions of people who are knoeledgeable in the field of security on whether it's a good idea or not to use SQLite for Identity storage (in terms of safety).
    – Emre Bener
    Feb 23, 2023 at 11:07

1 Answer 1

0

I beg you not go with SQLITE,

let a side that its a file based, and offer little to no encryption. If your app grow and go trending, you will have performance issues, even though its only for identity management.

If you are looking for alternative solutions for identity storage, there are several options available that you can consider:

  • MySQL: MySQL is a popular open-source database that can be used to store identity data. It offers robust security features and supports high levels of performance and scalability.
  • PostgreSQL: PostgreSQL is another popular open-source database that can be used for identity storage. It offers a range of security features, including encryption, and is known for its scalability and performance.
  • NoSQL Databases: If you are looking for a non-relational database solution, there are several NoSQL databases that can be used for identity storage. Some popular options include MongoDB and Cassandra.
  • Cloud-Based Identity Solutions: Another option is to use a cloud-based identity solution such as Azure Active Directory or Amazon Cognito. These services provide a range of features for managing user identities, including authentication, authorization, and user management.
  • Keycloak is an open-source identity and access management solution that can be used for identity storage in a web app. It provides a range of features for managing user identities, including authentication, authorization, and user management.
3
  • 1
    Performance is not a security concern. And why would the lack of encryption be an issue in this context? This sounds more like a "I just don't like SQLite" response.
    – schroeder
    Feb 23, 2023 at 8:56
  • 1
    NoSQL databases are not supported by Entity Framework Core. Cloud-Based Identity services are not an option for me. Keycloak seems to be an Identity library, and it seems like a good one, but I am happy with the one I use (ASP.NET Core Identity by Microsoft), and the main concern is where and how I store the Identity data.
    – Emre Bener
    Feb 23, 2023 at 11:16
  • Availability is a security concern. I've worked with people who insist that if the lights on the box are still on then the service is available - IMHO seriously degraded performance is an availability issue. OTOH, while I sympathise with the sentiment, I think it is over-stated here.
    – symcbean
    Feb 7 at 13:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .