Hello!
I am curious... What is the correct way to handle security and Mysql (jdbc://) datasources in CF7?
Example:
jdbc:mysql://xxx.xxx.xxx.x
If I set a datasource up and call it Randy anyone can use it on the server if they were to guess the datasource. How do i prevent that? I have to add the username and password when creating the datasource otherwise it will not go through.
Is the only option to pick a random datasource name? I see cfquery has a username and password arguments available, but I do not see how that would work since the datasource has already been verified when added. I did see the username and password if sent via cfquery could override the datasource username and password in the cfadmin. I am not sure how that would help.
Thanks!
Randy
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
ok lets say you and I both have a website on a server. pigmentarts.com is your domain name randyexpert.com is my domain name. Your datasource is called pigmentarts and my datasource is called randyexpert. What prevents you from using my datasource in your coldfusion pages to look at my database?
-Randy
If you are using any edition other than one that supplies SandBox functionality than your data source could be used by another website. However if a user name and password is specified in the creation of the data source than it is much more difficult to accomplish this task. With Sand Box security, data sources are assigned to specified websites and all others will be given a access denied error.
I think what pigmentarts is getting at is if you're using mySQL and you specify a username and password required for access on creation, then you would need to specify these in the cfquery tag in order to access it. If you can access as anonymous, then your mySQL database has not been created with explicit security permissions. Just something to look at. I've never had a problem with this. I have several MSSQL databases that have security and require authentication which I do through cfquery.
Business Accounts
Answer for Membership
by: pigmentartsPosted on 2006-12-31 at 09:07:31ID: 18221742
hi, i am not sure if i get what your saying sorry. but when i set up my databases i set up a username and password for that database. the username and password arguments in cfquery are not for the datasource but the database itself.