CODEWITHSUNDEEP
androidmysql
chris
chris

Reputation: 36957

Android to Web Server Development mySql

I am in the process of developing an app with the help of someone else for a site I am developing. This app being developed will require access to the database on the web server. So my question here is typically I would want to keep my servers access limited to specific IP's however. Mobile devices all have there own ip's from what I hear. So if this is the case I essentially have to open up my database access to allow any inbound remote connection. Which is more than possible, but I forsee a potential security risk with that. namely in the notion of someone attempting to brute force the DB to gain root access or something to the effect there of. With that my question comes down to is there a more secure way of doing what I need in the overall? Is there any methods I can apply that would allow me a little more peace of mind. The DB I am currently using is mySQL, and will generally remain that type til later in the future.

Upvotes: 1

Views: 504

Answers (2)

mchandler
mchandler

Reputation: 926

Your concerns about security risks are valid. You should avoid a situation where countless mobile apps are making database connections to your MySQL database. A better solution would be to host a REST API layer in front of the database. This would allow you to control what portions of your database are accessed, but potentially include authentication routines as well. The REST web services you publish will give you the opportunity to produce permitted representations of your data rather than raw access to the data. That means in addition to producing web services, you'll need to develop the app to be a REST client that consumes these services or makes "requests" to them on an as needed basis. Obviously, this requires planning on both sides of development (back-end and front-end).

One possible solution to consider for producing REST web services is here:

http://phprestsql.sourceforge.net/

There are additional frameworks available for PHP, Java, ASP.NET and other platforms.

http://peej.github.com/tonic/

http://jersey.java.net/

Good luck!

Upvotes: 2

oluwasogo ojo
oluwasogo ojo

Reputation: 108

Why not access the database via an API and then secure the API? So in essence, you should have a REST(or anything) API on your web server which your mobile application talks to which subsequently talks to the database. Accessing and securing your API will make a more cleaner and leaner design.

Upvotes: 2

Related Questions