5 ms·
the solution is simple, give access to your database only to people you trust and don´t access to your super important database from a public location using php
by flupkear 18y ago
the solution is simple, give access to your database only to people you trust and don´t access to your super important database from a public location using phpMyAdmin!
- gaika 18y agoThat's not a solution. You can read more about XSRF and how to protect against it: http://en.wikipedia.org/wiki/Cross-site_request_forgery http://en.wikipedia.org/wiki/Cross-site_request_forgery
- nilobject 18y agoI have my phpMyAdmin installed only on my secure site, behind HTTP authentication as well.
- rcoder 18y agoIf you're using HTTP Basic auth, your browser will happily cache the credentials and re-submit them every time when asked for the same server/realm combination. You'll need to restart your browser to clear the cached auth data.
- simonw 18y agoThe reason CSRF is scary is that it works against those defences.
- rcoder 18y agoActually, the solution is not to ever use phpMyAdmin on a public web server. Just like Webmin, and every other tool that has god-like power over critical system resources, it should be on a private IP, accessible only from trusted systems via an encrypted, strongly-authenticated channel.
- jrockway 18y agoThis doesn't help. If you use the same web browser for using phpMyAdmin that you use for visiting the attacker's site, you're hacked.
- rcoder 18y ago"Strongly-encrypted channel" basically means VPN in my book. If the phpMyAdmin server isn't on a publicly-routable IP, and you don't have the VPN tunnel open when you aren't using the secure host, then it will in fact defeat CSRF.
- simonw 18y agoAgain, CSRF defeats those defences.