recently I hired a freelancer to develop an iPhone application for my website, this application will get information from the DB of the website, normally I should give to him the access to the DB to take the information needed. The question is, how to let him take the information needed without safely, i.e preventing the danger from hacking or accessing to the DB of the website or do some modifications on it... What can I do ?
Add a comment
|
3 Answers
Without knowing more about your site and iPhone app, here are a few questions you need to ask yourself:
- Does the developer/iPhone app need direct access to the database? If you're concerned about security, is it possible for your website to expose the needed portions via an authenticated web service?
- If it is necessary to provide direct access to the database, is it possible to mitigate the risk by having a read-only version for the application? Provide a userid that has access only to the portions of the database required for the app to work.
- Are your database/web site/server's patches and security practices up to date? Do all that you can to ensure that your data can't be hacked by following best practices in this area.
-
Thank you for your answer, actually the developer need some information from the database, so how can I let him take those information without any risk ?– ZikoozDec 2, 2011 at 17:12
-
@Zikooz - What sort of information is in the database exactly? The developer should not need access to the database to write the software. If you tell him the exact schema of the database he should be able to write the required code. If he needs test data, then setup a test database, and provide him access to it.– RamhoundDec 2, 2011 at 17:53
-
@Ramhound - And if I want that he takes some information from DB, can I create a .php page that contains the informations of DB, then he can include it into his code without know the password and the other information of DB, So, is it safe or not ?– ZikoozDec 3, 2011 at 12:18
I am not sure , how does it work in Iphone app, but I prefer the JSon calls When I use PHP. I think there is any method to call JSON from an Iphone application if it is HTML based.
-
Yes, Apple's SDK includes a simple JSON parser/encoder. And there are a variety of third party ones with more flexibility. Dec 2, 2011 at 21:04
Ideally, you'll be providing only indirect access to secured data via a service. This service will handle security such as identity authentication and security/access levels.
A quick Google and StackOverflow search will reveal several different service design options for connecting to a web service from an iOS device.
answered Dec 2, 2011 at 18:48
