I'm developing an ASP.NET Core 7 MVC Web App. I'm using ASP.NET Core Identity library to manage user and role data. I am considering using SQLite for keeping Identity information, separate from my actual database which is a PostgreSQL database. I want to know how possible it is for this SQLite database to be leaked/attacked, and what precautions I could take to mitigate risks.
The reasons I would like to separate Identity data from my actual database are;
- I would like to keep things tidy. I like the idea of encapsulating Identity data in its own database, separate from all the tables in my actual database.
- The identity database (if separated as an SQLite database) would be under no real workload, and queries would only involve simple selects and inserts, so keeping it local in the web server would most likely be no big deal in terms of performance (in fact, it might even be faster than using a remote dedicated database server).
- I use Entity Framework Core with code-first approach for data access, and unfortunately, the SQLite provider does not support encryption. I can't set a password on the SQLite database file for it to be encrypted
- Performance might become an issue (I don't believe it's a real possibility, as my Web App doesn't have that many users)
- The obvious risk of the SQLite database file somehow getting leaked (?)
- ASP.NET Core Identity hashes the passwords in User table, so even if the data were to be leaked, the passwords probably would still be safe.