I am writing a webservice for research and learning purposes and try to find an approach to seperate user data from other users to ensure a request can never deliver or reveal data from another user.

I give you an example in a slightly different field. Imagine a HTML form whose inputs will be written into a database. There is the browser logic which can ensure the data is valid. Then the script accepting the connection can revalidate the data as well, and often databases have their own constraints. So there are 3 level to ensure no spoiled or incorrect data makes it into the database.

Back to my initial problem. Imagine a database with user text messages. In a naive/plain database model, there would be a user and messages table where each message has a user_id. A SQL JOIN would be the naive solution, but that is way to error prone in my opinion.

Would it be ok to create an entire database for each user to seperate the data even more? Would that be enough? How do modern webservices seperate data?

FYI: The text message example is just an example. Of course I know about end-to-end encryption. But for my webservice this is not necessary to go that far.

  • 1
    Why do you consider a join error prone?
    – JacquesB
    Jun 1, 2020 at 21:05
  • I should have clarified it. Because it is easy during year-long development cycles to make an error or mistake here. It doesn't add a seperate abstraction/seperation layer Jun 1, 2020 at 21:35
  • 1
    Separate databases does provide a layer of isolation, but is also going to be lot more complex when creating new users, schema changes etc. And you probably also have some data that is shared across all users, so you need to perform queries against multiple databases. In general I don't think it would be worth the added complexity.
    – JacquesB
    Jun 2, 2020 at 6:50


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.