5

I have an external java application which use JDBC as to reach a MySQL database.

This will be used by many people and is going to store all the people's data on the same server / MySQL.

As I bet people will be able to crack the .jar and see the source, I expect them to be able to cheat the program by editing it and making it get information from other users even when they are not allowed to reach said information.

Is there any standard way to protect a server so people should only be able to reach the information their account is connected to even if said people are able to change the source?

2 Answers 2

Reset to default
3

One way to solve the problem is by using a server-side program to get the information for the client instead of having the client connect directly to the server. This can be in the form of a webpage, service, or RMI.

The advantages of this is that the user never can access the database directly (which is a big no no), and therefor can't get access to others information or write their own data.

The disadvantage is that its complicated and requires external scripts. You have to figure out how your going to send information in between the server and the client thats not SQL based.

Sure its the obvious solution, but its not always the best. It completely depends on your app.

As an example, in one of my apps I had a server side PHP script that took a bunch of mode and option parameters. This returned all the information in JSON format and was parsed by the app. It was pretty basic, but it worked for my purposes.

For authentication when the app first started it asked the script for a session key (for you, you ask the script with a username and password). The session key was a really long randomly generated SHA512 key that was passed with all requests. For you, if the user shouldn't have access to something, then return an error.

Depending on how sensitive the information is, you could use HTTPS, text encryption, URL encryption, etc.

2
  • Thanks! Is there any easy or swift way to implement it? Problem is that we aren't that many and with a tight schedule. We would like to either keep it in a way to handle it with multiple MySQL or external if possible? PS: Thanks for fixing my grammar!
    – Skarion
    Commented Oct 2, 2010 at 19:41
  • @Skarion See update
    – TheLQ
    Commented Oct 3, 2010 at 0:51
0

You can either add security on the SQL server proper, by using different database user accounts for each user and handling security using SQL features; you might enforce security restrictions via stored procedures, security views, etc.

This might not be a great idea, though. SQL security is not great, MySQL might not implement all the features you need to effectively protect your data and it might involve lots of work on your side.

The other solution is to add an intermediator between your app and the database which is outside the end users' control. Have your app connect to another application, authenticate against it and have the second application enforce security. This application might be a webapp which exposes the necessary methods via web services/RPC/REST, whatever.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.