recently I hired a freelancer to develop an iPhone application for my website, this application will get information from the DB of the website, normally I should give to him the access to the DB to take the information needed. The question is, how to let him take the information needed without safely, i.e preventing the danger from hacking or accessing to the DB of the website or do some modifications on it... What can I do ?
Without knowing more about your site and iPhone app, here are a few questions you need to ask yourself:
- Does the developer/iPhone app need direct access to the database? If you're concerned about security, is it possible for your website to expose the needed portions via an authenticated web service?
- If it is necessary to provide direct access to the database, is it possible to mitigate the risk by having a read-only version for the application? Provide a userid that has access only to the portions of the database required for the app to work.
- Are your database/web site/server's patches and security practices up to date? Do all that you can to ensure that your data can't be hacked by following best practices in this area.
Ideally, you'll be providing only indirect access to secured data via a service. This service will handle security such as identity authentication and security/access levels.
A quick Google and StackOverflow search will reveal several different service design options for connecting to a web service from an iOS device.