在应用程序中使用直接MySql连接-C＃

Question

I have developed an app, which more than 2k users are going to use it. This app is connected to a database which contains some data. I have some questions: 1. Is it ok to use mysql direct connection in app instead of API for just reading data? 2. Is there a way that someone find my server's information (address, pass, etc) from my application?

App is wpf.

Answer 1

Generally speaking (and as with all generalities there are all kinds of exceptions here, in both directions) it's okay to connect directly to the database if one of these two conditions is met:

1. The app and the database are on the same computer

or

2. The app and the database are on different computers, but within the same corporate network and traffic between the app and the database is adequately protected.

and if one of these conditions is also met:

1. The end user owns the app and doesn't share data with other users (they break it, that's their own problem and no one else's)

or

2. You issue separate accounts with only the necessary privileges to each user (the user owns the credential)

or

3. The machines where the application is deployed are controlled by the business, where you can securely deploy the application (and the account credentials it uses to connect to the database) in such a way that end users are not able to retrieve the account credentials directly. (The business owns everything).

It is not generally okay to connect directly to a database over the public Internet, or within a local network where traffic to the database is not adequately protected, and it is not generally okay to let end users have direct access to the database separate from the application (and if a user has ownership of their machine, they will be able to get that access).

---

I also need to expound on what I mean by "adequately protected". This involves a few things:

• A good firewall between the clients and the database. In some smaller environments, the firewall on the OS hosting the database itself may be enough.
• Measures to prevent MitM attacks on data packets to and from the DB. For traditional corporate networks, this usually means 802.1x is running even on the wired network, and wifi access is similarly protected (a pre-shared key wifi network like you use at home is not good enough, because anyone who can get the key can decrypt your traffic). Alternatively, you can implement encryption that runs from the client all the way into such a protected network. This is what many corporate VPNs are for (a public VPN service doesn't accomplish this for you). You may also be able to encrypt that actual database connection traffic. I know how to do this for Sql Server, for example, though I'm less clear on what direct support is in MySql in this area.

Answer 2

If you save the information inside your application, it can be found. You should consider using an API to handle the data reading. Applications can be reverse engineerd.