客户端通过Internet访问SQL Server

Question

Does anyone have any opinions over the best ways to connect a client to SQL Server to get data.

So lets say I have a C# DataGridView in a Winform not on the internal network and I need to load it with a lot of data.

Currently to access the data we call a component SQLDataAdapter in the client which opens a connection to the SQL server, loads a DataSet and then closes the db connection. This is using SQL Server Authentication and there are many applications being ran over the internet connecting the same way at the same time.

So I want to increase security and not degrade performance. Which of these options or other options should I look into?

-Connect the same way but keep connections open for duration of the users time in the app.

-Create WebServices server and pass dataset or collection to client.

-Create WCF server and connect to db. (LINQ, Identify Framework, ADO.NET...?)

-Create both WebServices and WCF server, client connects to WCF, which gets data from WSE server which connects to SQL Server and passes collection or dataset back to client

Personally I like the last option the best for a few reasons. 1. It would be easy to take the components we already have built and drop them into web services. 2. It would allow us to stop having our ASP.NET websites access the database directly but connect through the Web Services server(ASMX to ASMX = good?). 3. We could have better control what data is accessed and given to outside of our network. And we no longer have to keep connection strings in our applications.

Does anybody have experience with these or a combination of these options? I am somewhat wary because I have heard horror stories about servers like this being funnel points when there was no problem just connecting straight to SQL Server.

Thanks

Jason Stone

-

Answer 1

In my opinion, you need a pretty compelling reason to allow direct connections to your database from outside of your network. Allowing remote Sql connections can be a big security risk if not done correctly. The industry learned this the hard way with the Sql Slammer virus etc...

Winforms/Wpf Client App -> WCF -> Database works really well in the real world. Also, hiding data access behind a service for your remote apps allows you to change your database and related objects without any client changes as long as the data shape passed back and forth remains the same.

On the flip side, any apps that have to serve a lot of concurrent users from one logical instance (such as web applications/sites go) should directly connect to the database.

In either instance, I don't really see the value of having another set of web services to hide the database from your WCF and Web Apps unless we are talking about a huge disparate enterprise system.

Answer 2

Have you checked out the ADO.NET DataServices (formerly known under codename "Astoria")?

It's a technology built on top of WCF with all the goodness of WCF, that allows you to fairly easily (but selectively and securely) expose a data model (typically an ADO.NET Entity Framework model, but Linq-to-SQL or other technologies work, too) as a RESTful service to the internet.

You have full control over which parts of your database are actually represented in the model, and then you have various levels of access in the model - you can allow read for collections (eg read a list of all products), or just read of individual items, or even things like updates, inserts or deletes - all under your control.

With the REST interface, using it is simply browsing to a given URL and then drilling down or linking across the model from there.

There's also a client-side API to use, so you can easily and quickly display your data and offer the user navigation within the data. You should definitely check out the PDC08 talk on Developing Applications Using Data Services with Mike Flasko, and Offline-Enabled Data Services and Desktop Applications with Pablo Castro.

Definitely a good idea, and a very quick and yet safe way to get your data onto the internet! Check it out.

Marc

Answer 3

What @Auger said, plus, get yourself an SSL certificate and server everything over HTTPS. This way its secure and it's handled by IIS at a low level, so you know you are getting the best performance.