search

arrowhead-f / core-java

Arrowhead Core Framework Implementation in Java
https://forge.soa4d.org/plugins/mediawiki/wiki/arrowhead-f/index.php/Main_Page
Apache License 2.0
4 stars 12 forks source link

MySQL Connection Security #21

Closed eudyptula closed 6 years ago

eudyptula commented 6 years ago

Currently, we're using useSSL=false&allowPublicKeyRetrieval=true in the MySQL connector string. This opens for potential vulnerabilities to consider. See https://mysql-net.github.io/MySqlConnector/connection-options/

uzoltan commented 6 years ago

Can you tell me why those are necessary in the connection string? When testing on Windows, I dont need either of these. What happens when you do not provide those on debian?

eudyptula commented 6 years ago

I added the latter recently - maybe caused my MySQL 8. Can't remember, I'll retry and give you the error message ;)

eudyptula commented 6 years ago

MySQL 5.x & Oracle Java 8... OK MySQL 5.x & Oracle Java 11... OK MySQL 8.x & OpenJDK... OK

Hmm, weird :S - I guess that useSSL=false was something with the old connector version, and setting that to false required allowPublicKeyRetrieval=true on some of the newer versions. Removing both seems to work all all three combinations above.

Pull request #25 should do the trick...