Background information

I have a database that will be used by two different web applications. Solution A (user driven web application) resides on the public internet and will write / update / delete records to the db. Solution / Service B (not user but process driven) resides behind the FW and will only read the data from the db. For discussion purposes, let's just say that the db server will be set up in a way that it is accessible by both Solution A and B.


I'm trying to analyze what the best way is to set up the database server so that both applications A and B can interact in a secure way, but also be as loosely coupled to the database server as possible.


So far, I was thinking about creating 2 web API's on the database server. One would expose a read only interface for Solution B. And the other would be read write for Solution A. However, the question that comes to mind is how should I authenticate requests coming into the DB server from Solution A? If this db server is on the internal network, should I care since i "know" the users would have been authenticated when they hit the public facing server? If I do need to care, can I have solution A forward the JWT over to the internal db server? I think I would need to interact with the identity server from the DB server once again for the JWT to be of any value right?

Any comments or suggestions would be appreciated.


  • Traditionally you just use a random password that goes in the configuration file Commented Jan 22, 2021 at 20:56

1 Answer 1


Creating two WebAPIs and deploying them on the database server that are tailored for-each of your solutions, doesn't making them loosly-coupled to the database server.

In my opinion the database server should have a clean and expressive API exposed for trusted entities that you configure it to interact with.

I think that you should deploy a trusted entity like this to be a connector/broker for solutions A/B and it'll handle requests, authenticate them, apply security measures and permissions as you desire and only then it'll transfer it as uniform API calls to the database server and hand the response back (maybe invoking business logic on the response too).

Applying strict authentication for any request if solution A or B is dependant on your requirements, the data resides in the database and more generally your threat model.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.