CODEWITHSUNDEEP
sqldatabasereactjssecurity
bdizzle
bdizzle

Reputation: 419

Keeping information private, even from database users

I have a unique use case. I want to create a front-end system to manage employee pay. I will have a profile for each employee and their hourly rate stored for viewing/updates in the future.

With user permissions, we can block certain people from seeing pay in the frontend.

My challenge is that I want to keep developers from opening up the database and viewing pay.

An initial thought was to hash the pay against my password. I'm sure there is some reverse engineering that could be used to get the payout, but it wouldn't be as easy.

Open to thoughts on how this might be possible.

Upvotes: 1

Views: 42

Answers (1)

The Impaler
The Impaler

Reputation: 48810

This is by no means a comprehensive answer, but I wanted at least to point out a couple of things:

  • In this case, you need to control security at the server level. Trying to control security at the browser level, using Javascript (or any similar frameword like ReactJs) is fighting a losing battle. It will be always insecure, since any one (given the necessary time and resources) will eventually find out how to break it, and will see (and maybe even modify) the whole database.

  • Also, if you need an environment with security, you'll need to separate developers from the Production environment. They can play in the Development environment, and maybe in the Quality Assurance environment, but by no means in the Production environment. Not even read-only access. A separate team controls Production (access, passwords, firewalls, etc.) and deploys to it -- using instructions provided by the developers.

Upvotes: 1

Related Questions