CODEWITHSUNDEEP
mysqlnode.jsreactjselectron
scarably
scarably

Reputation: 333

What are the risks of connecting to database directly from Electron app?

I'm fairly new at building Electron apps and I've seen a lot of examples where Electron app connects directly to a remote database (MySQL in my case) so I started wondering what the problems might be with doing it that way. My first thought was to have a remote API (built on top of Express) which would communicate with the database and Electron app (React) would just utilize that API.

Any advice? Thoughts?

Thanks.

Upvotes: 2

Views: 1837

Answers (1)

jfriend00
jfriend00

Reputation: 707328

A problem with directly connecting to the database is you have to embed the database credentials in the electron app which makes them available to anyone who wants to snoop through the code. In addition, once the credentials are exposed, you lose control over what anyone can do to your database.

This is why you would usually give the user their own credentials, have the user authenticate to a web server and then have the web server be the only one who can directly talk to the remote database. You can then completely control what happens to the database since your web server is the intermediary and the only one that actually talks to the database.

This doesn't mean that there aren't some circumstances where you might want the client to talk directly to the database as it really depends upon what you're doing, what the data is and what the risk exposure is for allowing untrusted code to directly manipulate the data in the database.

Remember, you cannot protect credentials embedded in a client. They can be discovered by the client and used for other things.

Upvotes: 2

Related Questions