I have a question about access control/best practices in MySQL. I have a Database set up for a website. This database holds user login info and general customer/product info. I have separated the information into secure and un-secure information and created 2 schemas for them. Schema A holds non-secure info such as customer name, shopping cart, product names, prices etc. Schema B holds secure info such as uid, encrypted password, salt. I have a weblogin user that is utilized by the server-side scripting to access the database and have limited it's permissions to schema A. I then have a set of functions/procedures to register/validate/update passwords so the weblogin user can perform these functions without having access to the information in schema B.
So, my question is 2-fold A: does it make any difference in security to have the stored procedures/functions in schema A or B? Weblogin does not have drop/create access so in theory should not be able to modify them to do anything nefarious. I just would like to know if there are any gotchas with putting them in the A when they are accessing data in B, or putting them in B but having to GRANT EXECUTE permissions on them to weblogin. AKA which is more secure, or am I being pendantic?
B: for the user defined in the proc/func is root acceptable?
ex: CREATE DEFINER=root@localhostPROCEDUREvalidate_user``
Or should I create a separate user with granted access to that data for the definer?
I am looking for answers from anyone who knows any peculiarities about how these permissions work. It would seem as though there is no difference between them, but I am aware things aren't always what they seem. I am still learning about web security and trying to apply best practices wherever I can. Thanks in advance!
答案 0 :(得分：0)
DEFINER子句确定检查访问权限时要使用的安全上下文。
CREATE DEFINER=root@localhost PROCEDURE procedureName
将definer设置为当前用户。您可以在不使用＆＃34; DEFINER＆＃34;的情况下编写存储过程/例程。您可以在以下位置找到详细信息：
http://kedar.nitty-witty.com/blog/access-control-in-mysql-stored-routines-by-example-definer-invoker-sql-security