I'm a junior programmer, am working on a WPF application that will deploy to ~50 users.

We basically are streamlining all of his charting/tracking of client data. Each user will probably make about 25 read/writes a day.

I have everything working in Azure but my issue/fear/question is I'm directly calling stored procedures in the Azure SQL db for all CRUD/Loading operations... is this wise/correct? Should I be leveraging another technique like a web service? Never worked with web services or web apis or web workers.. etc.. I'm basically just doing what it takes to make it WORK.

Again... I'm a junior dev...& I know just enough to be dangerous.

My concerns are that it is less secure and I'm afraid of higher costs from Azure because I'm doing something a bad or terrible way.

  • The answer can be found in this question tl;dr: exposing your DB locks you to that DB and creates another vector of attack. – ratchet freak Jun 10 '15 at 14:51
  • Are you passing information over the public internet? – Robert Harvey Jun 10 '15 at 14:51
  • @ratchetfreak Is implementing a web service the best option? WCF? Very new to all things webby. Have been stand alone/intranet developer for most of my experience. – markokstate Jun 10 '15 at 14:54
  • @RobertHarvey I assume I am. There is no way to access program other than running it. But the users are all in various states and will be connected to WiFi. (could potentially even be a starbucks shop) – markokstate Jun 10 '15 at 14:56
  • Web services would be a better way to go. But that's just an additional software layer between your stored procedures and your WPF frontend, and you can probably set it up fairly easily with ASP.NET MVC Web Services. – Robert Harvey Jun 10 '15 at 15:00

The answer to your question will be mostly decided on the below points.

  1. Will your WPF application be limited to those ~50 users or there is a scope of increasing userbase..

  2. What kind of Read Write operations the user are doing. (Do you really need security)

  3. Will your WPF application be the only client for that data (is there any possibility that the application be ported to mobile devices like android)

The reason behind questions is 1. if your application is only being limited to those ~50 users and you know the users are nonTechnical (They will not try to break the system using erroneous input or trying to call the database layer eg. with sql injection attack) in that case you can use the direct SP call from your application.

2.if the data that your users are posting to database or retrieving from the database is very confidential and should not be visible to anybody snoofing the traffic. then in that case you should try to have a more secure way of transport. One way can be implementing the SSL certificate for accessing the data to and from the web service.

3.If the data need to be accessed by different clients (including mobile devices, Web applications etc. In that case also implementing the services is always a better option as you have the complete data access layer separate with proper security implemented)

I hope this answers your question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.