3

I am developing a web application which will be run by multiple companies.

Each company will have its own instance of that web application and its own database. The web applications and databases will be running on the same server.

But each of these instances will be talking to one single Web API application to retrieve data from their database for that specific company.

My question is that I am wondering whether it is a good practice to change the database connection string in the Web API application based on the request origin? Or am I overlooking something?

  • 2
    Will the companies be hosting their instance of the web application on their own servers, or are they all connecting to your server? – Bart van Ingen Schenau Dec 23 '15 at 20:16
  • 1
    @BartvanIngenSchenau I will be hosting all the web applications and databases – Johannes Dec 23 '15 at 20:41
3

Now I am wondering whether it is a good practice to change the database connection string in the Web API application based on the request origin?

It depends upon what you mean by "based upon the request origin." If you're referring to something that the client controls, such as an IP address, then what you're considering is likely a bad idea. Things controlled by the client are easily spoofed and are effectively an invitation for mischief.

On the other hand, if you're referring to something that isn't easily spoofed, such as a client authentication token, then what you're considering is fine.

I can't tell which architecture you're planning on using.

Option A

          +->Application
          |
 Web API+->
          |
          +->DB

Option B:

Application+->Web API+->DB

In either case, the general concept that you're grappling with right now is termed "authorization."

Authentication is a related concept, but refers to the client proving they are who they say they are. Typically authentication is done with passwords, certificates, tokens, etc....

Authorization is related to providing access to functionality based upon who the client authenticated as. Determining database connection strings based upon client authorization is a fairly typical case for authorization.

If you happen to be using Option A, then the Web API will determine DB and application access based upon the client's authorization privileges. And if you happen to be using Option B, then you'll need to make sure that the application passes along the authentication token into the Web API so it can determine the correct DB for access.

3

It is a bad idea to rely on anything the client provides for access control other than a shared secret that is difficult to spoof.

Request origin is easily spoofed.

  • 2
    The shared secret is usually a key pair generated by the client organization. They send you the public key, and add an encrypted hash to each request. Then your only responsibility is to verify the hash. The security of the private key is the client's problem. – kevin cline Dec 23 '15 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.