3 ms·
You will need to have the database accessible for the process serving the web page and there's no way around that. When using a database stored elsewhere, the
by fogihujy 6y ago
You will need to have the database accessible for the process serving the web page and there's no way around that.
When using a database stored elsewhere, the config file will still contain the user name and password, but the user's permissions could be restricted in order to prevent access to parts of the data in the database.
In the real world though, 99% of all web sites run with a user with full permissions anyway, so if the site gets compromised, you're screwed regardless.
- collyw 6y ago> In the real world though, 99% of all web sites run with a user with full permissions anyway, so if the site gets compromised, you're screwed regardless. Yeah, I was kind of working under that assumption.
- emj 6y ago> 99% of all web sites run with a user with full permissions In my professional career it's 0% for public facing apps, the simplest custom CMSs based systems I maintain has seperation between database users for a 100MB DB. Many of the newer ones have a sync to read only copies for most of the actions that the app needs to do. 99% sounds horrible, I can't even imagine how you could get to such a state! Sure considering how bad login is handled every where (even in SAML), it's not that surprising.
- fogihujy 6y ago> I can't even imagine how you could get to such a state! 1-click-installers for Joomla, WordPress, Drupal, etc. Most shared hosting providers give the database user full access to the entire database as default.