Privacy Settings Equivalent and Database Security in Wappler

From Bubble to Wappler
#1

Hello there Wapplers…

My app has lots of Users who record what can sometimes be classified as personal information about their clients.

So as I start planning my database, I think about how important data security is, and how much I use the privacy settings in Bubble. (These are settings which restrict access to database tables and fields according to quite complex rules you can set up).

Any pointers you could give me to research the different ways of managing database access and security would be great. I’m guessing solutions lie in Wappler, PHP, mySQL and my choice of database host.

I’d love to hear your experiences!

Best wishes,
Antony.

#2

That’s easy to set up, using the security provider in Wappler:

2 Likes
#3

@Antony how did you end up implementing this regarding restricting access to only specific pieces of data?

The simplest method would probably be an addition WHERE clause in every query restricting data to an ID, but I’m not sure that’s the best. That feels easy to fool.

#4

Great question Zach!

I have done pretty well exactly what you said… I search each time by both the id of the database row/record AND the id of user it belongs to…

… but I use the user id returned by the Security Provider server action step, so the value I’m passing is hidden away from the user and totally on the server side.

It is also important to make sure that EVERY server action you have in your app has the Security Provider and Security Restrict steps in them if they are GET based actions, as those can be accessed from anyone who has the url to the action.

I don’t claim to be any kind of security expert, but from what I know that feels pretty safe.

I’d love to hear from anyone else if they agree!

Best wishes,

Antony.

#5

Ah, yes. This is key. Makes sense now. Thanks!

1 Like
#6

Not only GETs. Any method.

What you are trying to convey I think is that browsers will send GET requests by default when you visit a URL.

But you can also send a POST and retrieve data. Actually with any type of request(GET, POST, PUT, PATCH, DELETE). It all depends on the server implementation. So secure everything that can be secured.

1 Like
Make all APIs restricted by default
#7

Thanks for that update Jon… I always appreciate hearing your views on app design!

So here is a question… I am building a booking form for my user’s clients. I don’t want the clients to have to create a login when they visit the booking form page.

The booking form then has to make numerous database calls to get the booking information required - contact’s details from a search on their email address, details of the event they are booking on, a whole stripe checkout process.

I’ve implemented the database calls so far using only POST based actions, in the (maybe naive) assumption they are quite safe…

Would you have any recommendations about what is the most secure way to implement the database access server actions for a booking form?

Best wishes,
Antony.

#8

There’s nothing to worry about using such a booking form.
Of course you don’t want to enable output options for the Server Action steps (providing sensitive data) which are only required and used in your Server Action and not really needed on the front end. :slight_smile:

#9

Thanks for that feedback Teodor!

I have been very careful only to set the output on values I know are safe to pass back to the front end… so for example the xxxxxxxx789 question I had a couple of days ago was about exactly that.

But @JonL seems to think POST actions can be hacked from the front end too if there is no security login process, so I am interested to understand more about that…

I guess like many Wapplers, my experience of web and app design is limited to this one project, so there is always more to learn and security is very important for me!
:slight_smile:

#10

Well of course when managing data and you require users to be logged in, you always secure your server actions :slight_smile:
You should never leave any of the server actions from your backend accessible for the public.

Server side validation for post variables + security restrict is what you need to be sure everything is secured :slight_smile:

#11

Good to see @Antony asking my questions for me :smile: one of the advantages I am starting to learn as not the first Bubble user. I had this very question and was trying to figure out the best way to secure the app. I do like that it is a transparent process and from a builders side of things!

1 Like