News for hackers. Stuff that matters.

A comment on Multi-Tenant Architectures. Parent comment

Re:Multi-Tenant Architectures by treis on Sunday August 30, 2020 @08:29PM (#24327298)
A SQL injection bug is (probably) not that big of a deal as long as the tenant boundary isn't crossed. They'd be stealing their own data.
[ Parent | on HN ]
Re:Multi-Tenant Architectures by rubber_duck on Sunday August 30, 2020 @09:18PM (#24327572)
True, I'm just not sure that I'd trust the DB isolation once the user has SQL injection. I never saw a SQL injection report on a project (well since the PHP days) ORMs solved this for the most part, but I did see multiple instances of accidental data leaks from bugs on different projects.

It looks like you could also use SET SESSION AUTHORISATION for this but I haven't used it so I don't know how this works with data access/pooling

[ Parent | on HN ]