3 ms·
I suspect it's a side-effect of the fact that web frameworks tend to encourage "pass the database login once and let the framework manage everything", so there
by misnome 14y ago
I suspect it's a side-effect of the fact that web frameworks tend to encourage "pass the database login once and let the framework manage everything", so there is no protection if you manage to get into whatever is running the site.
- sk5t 14y agoThe "one database login" rule (a.k.a. trusted platform design) doesn't necessitate reading the raw password hashes; the app account can be granted only permission to run a stored procedure that does the comparison yielding a yes/no answer, and denied 'select' on the views/tables/etc.
- shabble 14y agoYou should remember to use constant-time comparison when checking for equality in your stored procedure though; do databases typically provide functions/operators for that? It's something just as easy to get wrong in application code, but good frameworks already do, and abstract it away where you might not realise.