In the simplest form, our (near future) project consists of a end user program, that directly connects to databases and apis.

This is obviously bad as then the end user program consists of sensitive data such as usernames and passwords.

How do I avoid this properly?

searching on the web seems to point to Remote Method Invocation, wherein I put all sensitive data into an program that lies on an web server and end user program simply calls the methods from server program. Is this the right way or is there a better one??

1 Answer 1


Don't connect to databases from a user's machine directly sooner or later someone will find the password in your application and create havoc. Databases are very vulnerable to DoS attacks even from read-only access.

Instead only go through a webserver api that you treat as a public-facing api and secure accordingly with rate limits and revocable authentication tokens. Whether you will document that api is up to you.

  • But what is the right way to build such an API? Should I make a program that listens on a TCP/UDP port for input string and performs appropriate stuff? or should I use RMI? or is there another better way? Commented Feb 9, 2017 at 11:17
  • Sorry but I am a student and kind of noob about this stuff as I have never done remote api's before (except the usual TCP/UDP networking stuff). So I have no idea about how this is to be done, or what would be appropriate. Commented Feb 9, 2017 at 11:29
  • 2
    @RegisteredUser RMI is generally considered old-fashioned these days as it ties you to a particular implementation technology (e.g. Java, C#, etc). The most popular approach these days is to use a REST API, which is basically a web server that serves up data in response to particular requests, usually formatted in JSON. There are lots of server and client side frameworks that can be used to implement these, and it shouldn't take you too much time to get to grips with one of them and put a server online. Commented Feb 9, 2017 at 13:42
  • 2
    As you've tagged your question as relating to Java, I'll point you towards Spring MVC as a popular way of implementing this, along with Spring Security to handle validating usernames & passwords of your users as they connect. You may want to consider using Spring Boot which packages these up along with a web server in a ready-to-run form so you can just add functionality without messing around with the frameworks. There are lots of online tutorials, etc that will help you get it going. Commented Feb 9, 2017 at 13:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.