CODEWITHSUNDEEP
securitynhibernateormdata-access
Ray
Ray

Reputation: 192406

What are best practices to implement security when using NHibernate?

Traditionalist argue that stored procedures provide better security than if you use a Object Relational Mapping (ORM) framework such as NHibernate.

To counter that argument what are some approaches that can be used with NHibernate to ensure that proper security is in place (for example, preventing sql injection, etc.)?

(Please provide only one approach per answer)

Upvotes: 9

Views: 3248

Answers (7)

David Watts
David Watts

Reputation: 2289

Most ORM's handle SQL injection by creating parameterized queries. In NHibernate, if you are using LINQ to NHibernate or the Criteria/Query over methods of writing queries, the queries are automatically parameterized, if you are dynamically creating HQL/SQL queries yourself you are more vunerable and would have to keep in mind that your queries would have to be parameterized.

Upvotes: 1

Igor Brejc
Igor Brejc

Reputation: 19004

OWASP mentions one form of SQL injection vulnerability in the context of ORM tools (and gives HQL injection as an example): http://www.owasp.org/index.php/Interpreter_Injection#ORM_Injection

Upvotes: 0

Ben Scheirman
Ben Scheirman

Reputation: 41001

One of the arguments I've heard in favor of sprocs over ORM is that they don't want people to do whatever they want in the database. They disallow select/insert/update/delete on the tables themselves. Every action is controlled through a procedure which is reviewed by a DBA. I can understand where this thinking comes from... especially when you have a bunch of amateurs all with their hands in your database.

But times have changed and NHibernate is different. It's incredibly mature. In most cases it will write better SQL than your DBA :).

You still have to protect yourself from doing something stupid. As spiderman says "with great power comes great responsibility"

I think it's much more appropriate to give NHibernate the proper access to the database and control actions through other means, such as audit logging and regular backups. If someone were to do something stupid, you can always recover.

Upvotes: 2

Matt Hinze
Matt Hinze

Reputation: 13679

http://weblogs.asp.net/fbouma/archive/2003/11/18/38178.aspx

Upvotes: 1

scott.caligan
scott.caligan

Reputation: 704

Protect your connection strings.

As of .NET 2.0 and NHibernate 1.2, it is easy to use encrypted connection strings (and other application settings) in your config files. Store your connection string in the <connectionStrings> block, then use the NHibernate connection.connection_string_name property instead of connection.connection_string. If you're running a web site and not a Windows app, you can use the aspnet_regiis command line tool to encrypt the <connectionStrings> block, while leaving the rest of your NHibernate settings in plaintext for easy editing.

Another strategy is to use Integrated Authentication for your database connection, if your database platform supports it. That way, you're (hopefully) not storing credentials in plaintext in your config file.

Upvotes: 7

Kevin Pang
Kevin Pang

Reputation: 41442

Actually, NHibernate can be vulnerable to SQL injection if you use SQL or HQL to construct your queries. Make sure that you use parameterized queries if you need to do this, otherwise you're setting yourself up for a world of pain.

Upvotes: 6

Brett Veenstra
Brett Veenstra

Reputation: 48524

Use a dedicated, locked-down SQL account

Upvotes: 3

Related Questions