0

Database designers building enterprise systems usually assign different sets of privileges to different users of DBMS. They can be as granular as needed.

However, in my experience, web frameworks usually use a single connection to a DBMS, and the privileges are assigned and enforced at the framework level, through some sort of access control scheme. The database connection used by the framework has full privileges on the database, because it may need to create or delete tables, when extensions are installed or removed, for example.

Sometimes there are vulnerable extensions of a framework that may allow SQL Injection attacks. These extensions are often developed by third parties, and not by the framework developers.

My question is:

What is the efficacy of providing multiple DB connections with varying privileges for different user groups of a web framework - as a security measure? For example, the connection for a system administrator may allow for creating and deleting tables, but the connection for a public user may only allow for reading certain tables.

This would not be a replacement for the Access Control scheme in the framework, but as an added measure against SQL Injection.

Is this a good idea, or completely unnecessary? Please explain.

1

I think the easiest way to prevent this is to use prepared statements of some sort. Rather than worry about SQL injection as a permission problem, worry about it as an input problem.

That being said, I don't know how effective different connection strings would be. If you do find you want to separate your controls, I wouldn't do it by it user. I'd do it by access necessary. That way, a system administrator viewing content would have the lowest permissions he needed to do that. The connection would "elevate" itself once he or she needed to do something requiring CREATE/DROP TABLE permissions. That's probably a more robust solution.

| improve this answer | |
  • Thanks for you answer. The idea of 'elevating' the connection if additional permissions are needed is an interesting one. – Ron May 4 '14 at 22:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.