3 ms·
Interesting. So one would have to use the db permissions for each user instead of one db user approach of modern web apps. I guess all of the Man in Middle sec
by togasystems 16y ago
Interesting. So one would have to use the db permissions for each user instead of one db user approach of modern web apps.
I guess all of the Man in Middle security considerations would still apply.
Does you service/users use triggers as security as well?
- david927 16y agoIt can be role based, so you could still have one role for all users, such as view and insert only for a forum. But our solution has an interesting twist: security is managed like queries. For example, taking a sports social network, a team's messages can be sent [an insert] by team members, but seen [view rights] by members of the team and their friends. This is all set with two statements. It makes it so that you can go more often just directly to the database.