C#/C++ Client-Server application

Question

I'm coding an application which will be given to many clients, in order to not allow them to direct access to my database I started developing a server application with C++ which receives the client requests, interact with the database and send the responses. but this seems to be a little bit complicated, is it better to allow the client application to interact with the remote database ? and is there any risks with this?

First solution :

Second solution :

Answer 1

Typically you would abstract the database with an interface. A classic would be odata, which visual studio can build as an asp web service from a wizard. This is restful as Joakim recommended. https://en.wikipedia.org/wiki/Database_abstraction_layer

Answer 2

There are various options like the one mentioned by 'tim' which can be done without using ODATA; that means creating a data layer (separate application) which will cater the requests from client and wont let them access the database directly. However, before suggesting I would like to know how you are hosting the web application? You can still achieve no-access by client by blocking remote access to the database. The concerns depend on your code and structure; both approaches are valid!

Answer 3

if you have a C# client why not use a C# WCF server?

what you do in soultion 1 is usually the best practice. it allows you to: *later switch the database. *hides from your client the database's structure. meaning that if someone decompiles your client they wont know how to attack you.

but it is more complex and takes lots of extra work.

if you don't fear someone will hack your database . and you KNOW the database structure will undergo only very minor changes EVER . you can skip this and talk strait to the database.

but you are probably wrong.