对数据库连接应用最小权限
我注意到大多数 FOSS 应用程序（例如 Wordpress）仅使用一组已被授予所有权限的数据库凭据。这似乎违反了最小特权原则。
在编写这样的应用程序时，使用多个帐户是否会更好，例如，一个帐户仅用于 SELECT 查询，另一个帐户用于 UPDATE 等？
I've noticed that most FOSS applications (Wordpress, for example) only uses a single set of database credentials that have been granted all permissions. This seems like it violates the principle of least privilege.
In writing such an application, would it be better to use several accounts, for example, an account only for SELECT queries, another for UPDATE, etc?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
这绝对违反了最小特权原则。让我们回到定义：
在您的 WordPress 示例中，公共用户使用 SQL 帐户从数据库中检索数据，该帐户还能够更改或删除该数据。该用户的“最低权限”不包括更改该数据的访问权限，无论该数据是直接位于表上还是通过存储过程。这绝对不符合“仅访问其合法目的所必需的信息和资源”的规定。。
SQL环境中的风险主要是SQL注入。一个小缺陷，如果该公共帐户有权造成损害，那么你最终会遇到各种各样的问题。是的，应该验证输入，是的，应该对查询进行参数化，但这是额外的一层防御，可以为您提供一些额外的保险。
我在 OWASP 中专门讨论了这一点.NET 开发人员前 10 名第 1 部分：注入。
This is definitely a violation of the principle of least privilege. Let's go back to the definition:
In your Wordpress example, a public user is retrieving data from the database with a SQL account which also has the ability to change or delete that data. The "least privilege" for this user would not include access to change that data whether it be directly on the table of via a stored procedure. This is definitely not compliant with "access only such information and resources that are necessary to its legitimate purpose".
The risk in a SQL environment is primarily SQL injection. One little flaw and if that public account has the rights to do damage then you end up with all sorts of problems. Yes, input should be validated, yes queries should be parameterised but this is one additional layer of defence that gives you some extra insurance.
I talk about this specifically in OWASP Top 10 for .NET developers part 1: Injection.
我想如果只是为了维护问题的话，情况会更糟。一个用户意味着凭据位于一处，并且可以在同一位置为每台服务器更新它们。此外，大多数框架都假设设置一个凭据来统治所有框架，虽然允许两个以上的凭据并不太难，但更烦人。
有一些好处是，如果您有一个用户具有仅选择权限，则您不必担心 SQL 注入（当然不是在 Bobby Tables 级别），但即使这样也不能保证，所以无论如何你都必须清理你的数据输入（他们仍然可以基于 select 进行注入攻击......）。
I'd imagine it would be worse, if only for maintenance issues. One user means credentials are one place and they can be updated for each server in exactly one place. Further, most frameworks work with the assumption of one credentials set to rule them all, and while it isn't too difficult to allow for two+, it is more annoying.
There is some benefit in that if you have one user with select only privileges, you don't have to worry about SQL injection quite as much (certainly not on a Bobby Tables level), but even that is no guarantee, so you'd have to be sanitizing your data input anyway (they could still do injection attacks based on select...).
最佳实践是向存储过程授予权限，而不是在表级别授予权限。
The best practice is to grant privileges to stored procedures rather than at the table level.