Access ASP Security

Access Database Security On The Web (Part 1)

After working with Active server pages for a while, I went to the server and typed in the path to the database say http://www.gr-fx.com/database/northwind.mdb and the database started downloading to my local machine. Anyone could do this. So here was a question I put to my service provider

"Once you have transferred a Access database to an ASP site, what do you have to do to ensure that the database cannot be downloaded to someone elses site. Naturally I still need the visitors to read the database. Is this a case of only put on the site what you are happy to lose or is there some file protection settings that can be applied. By transferred I mean you type in the usr of the database say in the browser and it simply downloads as a file. Naturally the answer is fairly important."

And they answered as follows

"As the anonymous user needs access to the database for the asp pages to work this also gives them the ability to download the database IF they know the path to it. The only secure way is using Microsoft SQL server."

So what does this tell me given that I am not about to use SQL server yet. Firstly make sure that the database is not easy to find on the server by the following techniques.

Make sure that the directory that the database is in does not have directory listing authority for anonymous users.

Name the database directory something fairly obscure and maybe even the filename not *.mdb. (check with your ISP before you do this)

Only put on the web what you are willing to sacrifice

In the directory where the database is, place a file called default.htm. This will cause most browsers to open on this file rather than give a directory listing.

"Advanced Paranoid Users Article"

Click Here For for advice on secure databases as in this Microsoft Knowledge Base Article which is summarised below.

There are three main steps to using ASP files to query a secure Microsoft Access database:

- Use ODBC Administrator to create a System DSN that points to the workgroup information file (System.mdw) you use with your secured database.

- Create an HTML form that requests a username and password. The HTML form passes the values to parameters in your ASP file.

- Modify the script in the ASP file to use the HTML form to request the username and password parameters in order to authenticate user access to your database.

Garry Robinson - Sydney Based Consultant.