search

Zoclee / xojo-mongodb

MongoDB driver for Xojo.
15 stars 5 forks source link

Ability to use HTTPS to encrypt database authentication information #38

Closed funkytaco closed 10 years ago

funkytaco commented 10 years ago

I started to implement this and although the function is limited, it still works great, but do not see a way to use HTTPS. Right now, I'd be worried about a client sniffing the HTTP data for credentials. Normally the client is a web browser, so I guess that's why SSL security isn't usually a big issue with Mongo normally.

ghost commented 10 years ago

To support SSL (in)security a mongodb server must be built with the --ssl option: see the green note at the top of this page: http://docs.mongodb.org/manual/tutorial/configure-ssl/. Last but not least it also requires SSL certificate and keys but the link above is explaining all this quite well.

From this reading SSL support is hardly a mongodb driver issue...

This being said mongodb C++ driver has also SSL support (when built with --ssl option) but I doubt you could fully handle SSL from driver side alone: I would assume you'll need SSL on both ends.

Now imagine your xojo application encrypts client side data before it sends it (decrypting it when it get it back from server) - your data being stored encrypted in mongodb: SSL won't be required and your heart won't bleed when you'll have to discontinue database services to rebuild mongodb server and drivers for every OpenSSL security updates to come...

funkytaco commented 10 years ago

Hi, please treat me like a novice on this subject as I'm not a subject matter expert. So are you saying it is currently possible to encrypt communcation with this driver by simply enabling --ssl option on mongodb?

funkytaco commented 10 years ago

I'm not trying to hide the data. I just want to encrypt the authentication info.

  auth = db.auth("myuser", "mypassword")

I'm more worried about somebody sniffing the HTTP traffic for it, and deleting all the documents.

ghost commented 10 years ago

I don't follow you here - what HTTP traffic is that? Be aware the xojo driver is not using HTTP but native TCP sockets. If I recall it correctly db.auth() can be secured from the root - see: http://docs.mongodb.org/manual/administration/security-checklist/

alwyn1024 commented 10 years ago

For what it's worth, the user password is not sent in clear text to the server by the driver when a user authenticates, but compiled as a authentication digest. If a hacker sniffs the TCP traffic, then he/she will only find the username and digest key.

alwyn1024 commented 10 years ago

You can have a look at the source code of the MongoDriver.MongoDatabase.auth() method for more information on how the digest is compiled.

alwyn1024 commented 10 years ago

Adding SSL security on the HTTP layer is not within the scope of this driver.