Databases
StackOverflow2013
Postsdbo
POHow do I only allow access to my MySQL database from my iOS app? (Using webapp as gateway to db)
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POHow do I only allow access to my MySQL database from my iOS app? (Using webapp as gateway to db)
    primarykey
    data
    text
    <p>My iOS app needs to connect to a mysql server. To accomplish this, I'd like to create a webapp that acts as the middleman between the client side apps and the server side database.</p> <p>My concern is that someone can simply figure out the URL that my app uses and pass their own URL parameters - and since the webapp has no idea whether legitimate data is being sent from my iOS app vs. someone just typing in the properly crafted URL from any web browser, the system will be vulnerable.</p> <p>Let's say I have a PHP function for marking a user as "verified" (after I send them an email verification code). This is pretty standard stuff, but what's stopping someone from making the same request from a web browser?</p> <p>Of course, the user that the app uses to make database queries will have limited privileges, so the rest of the database won't be at risk. However, even having users activating their accounts from outside the app would be catastrophic.</p> <p>The option that I thought of was using https so that even if the user figures out the URL, they won't know the password and wouldn't be able to sniff it since it's encrypted from start to finish. Unfortunately, https can be expensive for a poor college student, so I'd like an alternative if one exists.</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. This table or related slice is empty.
    1. USblkhp19
    plurals
    1. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. COLet's see, you have an app sending HTTP requests to a PHP back-end right? Then it is technically impossible to shield your php from being hit from outside (or a hijacked version) of your app.
      singulars
      1. POHow do I only allow access to my MySQL database from my iOS app? (Using webapp as gateway to db)
      1. USFabrício Matté
    2. COSSL would be a good option to keep third parties from being able to sniff the credentials or session token from an authentic user. After that periodic regeneration of session id would make thing annoying for those that grabbed/guessed at a valid session id via nefarious means. Using techniques to combat [CSRF](http://en.wikipedia.org/wiki/Cross-site_request_forgery) might also be useful in weeding out auto registration bots.
      singulars
      1. POHow do I only allow access to my MySQL database from my iOS app? (Using webapp as gateway to db)
      1. USOrangepill
    3. COThe SSL might be a good idea, but don't rely only on your interface (app) sending valid data. Do the proper validation and escaping (preferably using the PDO or mysqli driver) before throwing user input into queries. (see the last two parts from my [answer](http://stackoverflow.com/a/18347112/1331430) on a related topic)
      singulars
      1. POHow do I only allow access to my MySQL database from my iOS app? (Using webapp as gateway to db)
      1. USFabrício Matté
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload