I asked elsewhere about the best way to store db credentials within a user-session of a web-app.
It appeared that it was for everybody but me evident that instead of heaving a db-role+passwd for every user of an application it was better to have just 1 set of db-credentials for the application and recreate a user management within the app instead using the existing user handling of the dbms.
That way the app checks the user's password as a md5 in some table and remembers "user is logged in" for later. The actual queries would be done with a common set of real db credentials.
Pro: Noone could bypass the app and use e.g. pgAdmin to access the DB instead of the app.
Con: A bug in the app could give anyone the access level of the app's credentials which might offer admin rights if such power is needed at least for some users.
What's your opinion?
Wel as usual 'it depends'
One perspective is to create all users in your database and use a combination of views, functions and storedprocedures to handle actions and events.
Basically this moves a great deal of management to the database instead of the app.
Benefit would be that the Database offers a fixed interface for communication and you can completely redesign the backend without impacting the interface to the app.
On the other end, when you use the app for those you often get a more finegrained control over functionality, since often (though not always) changing application functionality is easiser and you have the full power of PL/SQL at your direct disposal.
This does integrate more, but makes you a lot less flexible imho.
So it depends on where your (or your team's) skills are
For the rest it depends on the criteria for the app.
HTH
Just my 2ct
Kind regards/met vriendelijke groet,
Serge Fonville
Convince Google!!
They need to add GAL support on Android (star to agree)
http://code.google.com/p/android/issues/detail?id=4602
2011/12/14 Andreas <maps.on@xxxxxxx>
Hi,
I asked elsewhere about the best way to store db credentials within a user-session of a web-app.
It appeared that it was for everybody but me evident that instead of heaving a db-role+passwd for every user of an application it was better to have just 1 set of db-credentials for the application and recreate a user management within the app instead using the existing user handling of the dbms.
That way the app checks the user's password as a md5 in some table and remembers "user is logged in" for later. The actual queries would be done with a common set of real db credentials.
Pro: Noone could bypass the app and use e.g. pgAdmin to access the DB instead of the app.
Con: A bug in the app could give anyone the access level of the app's credentials which might offer admin rights if such power is needed at least for some users.
What's your opinion?
--
Sent via pgsql-general mailing list (pgsql-general@xxxxxxxxxxxxxx)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-general
