3 ms·
> I get all that but I still am unsure of what you mean. Direct database access would be like exposing ODBC from the DB directly to a web application. You eit
by lsllc 10y ago
> I get all that but I still am unsure of what you mean.
Direct database access would be like exposing ODBC from the DB directly to a web application. You either have to trust that the application doesn't do a "drop table ..." or hope that the DB has fine-grained enough access controls to prevent that.
Whereas in a SOA design, the API endpoint runs your code that gates access to the DB.
- SideburnsOfDoom 10y ago"web application" could mean a number of things. To me "web app" in the comments above meant the code on a server that handles http requests, not the browser client of it. You are talking about Javascript running in the browser of a random internet user, right? It could be catastrophic to allow that level of access to a database from the public web, obviously. As is pointed out in (1) that can happen already through carelessness. And it does (2) But it probably isn't what was intended in a newly designed general system. That would assume great stupidity. I suspect that even the "no code, just access the database" actually has some kind of code and config in front of the db, like odata (3). I'm not saying that odata is great, but it is an example of trivial access to a database. it's gated, mostly read-only and configurable, but it probably doesn't count as "writing a custom server app to gate to a database" 1) https://news.ycombinator.com/item?id=11925043 https://news.ycombinator.com/item?id=11925043 2) https://www.owasp.org/index.php/Top_10_2013-A1-Injection https://www.owasp.org/index.php/Top_10_2013-A1-Injection 3) http://www.odata.org/ http://www.odata.org/