2

I am doing some unit testing and noticed that if I click (or have multiple people clicking) the same filter very very fast (very precise I know;) eventually I get a "The connection is already open." error. I know that one way to solve this is to open new individual connections for each query each time it's called but I wonder if doing so opens my app up to a security risk -perhaps an easier time of a DoS/DDos attack?

Also, the connection is closed once completed.

If this is a risk, how can I (how do others) solve this problem?

2
  • Are you using ADO.NET interfaces? The reason I ask is because they have safely implemented connection reuse within the framework, so you should just dispose the connection every time you're done with it, preferably within a using statement. Oct 14 '14 at 20:13
  • I wasnt using ADO.NET but maybe I'll look into it... Oct 14 '14 at 20:28
2

It sounds to me like you're running into thread-safety issues. The fix for this, as you've discovered, is to not re-use connections.

To your question specifically, no, there is no security risk in opening new connections each time you need to connect to the database. You don't say what technology you're using (besides MySQL) but typically if you're following good coding practices such as only returning the data you need, and closing connections as soon as you're through with them, there should not be any significant increase in the risk of DoS attacks than when you re-use connections, and there may even be less by eliminating the threading issues you're seeing now. Additionally, if whatever data provider technology you're using offers connection pooling, this can eliminate the performance impacts of creating new database connections almost entirely, making perf a non-issue.

So, yes, you should be spinning up a new database connection each time you need to access the database. It's the safest option you have.

0

You should probably not execute database queries to filter data.

As far as my knowledge goes there is no risk with opening more connections other than a performance loss. It seems like the problem can be solved with some asynchronous message passing though.

If people can run a DoS attack by clicking a filter button rapidly you likely have more serious architectural issues.

2
  • How is searching with SQL different than searching with C#? That is if someone wants to ddos/dos me, they can do it either way regardless of my lookup procedures. I just tend to use SQL to do large lookups because SQL is optimized for that... Oct 14 '14 at 19:20
  • I'm not sure what SQL database you're using, but while the language is optimized for designing queries like that, the actual storage and retrieval mechanism usually lacks such optimizations. It's quite a shame actually. Anyways it seems quite obvious to me that caching the full results of a single SQL query and then filtering them in any programming language is far more efficient than repeatedly executing SQL queries to act as a filter.
    – zenware
    Oct 30 '14 at 17:58
0

No, it's not a security risk to open multiple concurrent connections to MySQL or any other real database (MS Access is not a real database). They are made to work like this.

The risk you can face is if someone starts more connections to the database than it can handle. In this case, other clients will not be able to be served in time. A DoS, effectively.

You can solve the problem using connection pools to access the database, and mitigate the multiple connections by the same source using filtering.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.