3 ms·

> almost all web applications run as root That‘s largely a configuration problem. They don‘t have to run as root, most of the time.

eloff 5y ago
With regards to the database. Not UNIX root.
eliaspro 5y ago
Should there ever be a web application that needs to run as root, it should be rewritten. All logic requiring root privileges should be moved into a separate system service with a minimal attack surface to which the web application delegates those special tasks.
- vntok 5y ago
  You misunderstood the grandparent's comment and replied to a confused parent. The application does not need to run as root, however even when it runs as a normal user, it generally has full read/write access to the application database. Which is a problem that is not easily solvable.
raxxorrax 5y ago
I think you need root permissions to start a network service on port 80 on Windows. There is a security risk here which was addressed in a fairly recent Chrome release that local addresses need a respective CORS rule. At least I believe so. Disadvantage with the Windows behavior is that a webservice running on said port has elevated permissions and if you surf the web with the same machine, a script inserted into a site could launch attacks against it. Of course the site itself could be malicious, in that case the CORS rule wouldn't do much. Of course you are correct, running directly on port 80 might just be a bad idea, but for development purposes I might do that.
- Vogtinator 5y ago
  Ports < 1024 are defined as "privileged", so it's not just a Windows thing. What usually happens is that the process only has the necessary capability for a brief period to open the port and drops it immediately before processing any requests.
iso1631 5y ago
It was poorly phrased, but the OP meant that web apps usually have full unrestricted access to the database. Clearly that's not entirely true (your webapp likely doesn't need truncate, or the ability to add/change stored procedures, or the schema) but it's broadly there. Your database is effectively chmod o+r

eloff 5y ago

With regards to the database. Not UNIX root.

eliaspro 5y ago

Should there ever be a web application that needs to run as root, it should be rewritten. All logic requiring root privileges should be moved into a separate system service with a minimal attack surface to which the web application delegates those special tasks.

vntok 5y ago
You misunderstood the grandparent's comment and replied to a confused parent. The application does not need to run as root, however even when it runs as a normal user, it generally has full read/write access to the application database. Which is a problem that is not easily solvable.

raxxorrax 5y ago

I think you need root permissions to start a network service on port 80 on Windows. There is a security risk here which was addressed in a fairly recent Chrome release that local addresses need a respective CORS rule. At least I believe so. Disadvantage with the Windows behavior is that a webservice running on said port has elevated permissions and if you surf the web with the same machine, a script inserted into a site could launch attacks against it. Of course the site itself could be malicious, in that case the CORS rule wouldn't do much. Of course you are correct, running directly on port 80 might just be a bad idea, but for development purposes I might do that.

Vogtinator 5y ago
Ports < 1024 are defined as "privileged", so it's not just a Windows thing. What usually happens is that the process only has the necessary capability for a brief period to open the port and drops it immediately before processing any requests.

iso1631 5y ago

It was poorly phrased, but the OP meant that web apps usually have full unrestricted access to the database. Clearly that's not entirely true (your webapp likely doesn't need truncate, or the ability to add/change stored procedures, or the schema) but it's broadly there. Your database is effectively chmod o+r