4 ms·
One of the problems you will encounter is that web apps don't usually log in as separate database users. Rather, all security is held in the business logic in t
by teyc 15y ago
One of the problems you will encounter is that web apps don't usually log in as separate database users. Rather, all security is held in the business logic in the web app. How are you going to prevent users from accessing data that they don't have permission to.
In addition, you need to prevent users from updating data without permission, or breaking your database consistency.
Usually, it is safer to put the db access code as business logic on the server instead of the client. It is roughly the same amount of code, but you don't have to worry about out of date clients etc.
- throwaway1964 15y agoBy design, the web service will limit what can be read from/written to the database instead of allowing the clients to run all sorts of database queries.
- teyc 15y agoSorry. I misread your intent. What type of "direct db connection" were you considering then?
- throwaway1964 15y agoYour points made sense, only that I was clarifying that the web service does indeed restrict what the client can/cannot do to the database i.e I'm considering having the clients just make calls to the web service which in turn does the SQL queries vs the clients having credentials for logging into the SQL server and actually running SQL queries.