3 ms·
The "one database login" rule (a.k.a. trusted platform design) doesn't necessitate reading the raw password hashes; the app account can be granted only permissi
by sk5t 14y ago
The "one database login" rule (a.k.a. trusted platform design) doesn't necessitate reading the raw password hashes; the app account can be granted only permission to run a stored procedure that does the comparison yielding a yes/no answer, and denied 'select' on the views/tables/etc.
- shabble 14y agoYou should remember to use constant-time comparison when checking for equality in your stored procedure though; do databases typically provide functions/operators for that? It's something just as easy to get wrong in application code, but good frameworks already do, and abstract it away where you might not realise.