Change database based on request origin

Question

I am developing a web application which will be run by multiple companies.

Each company will have its own instance of that web application and its own database. The web applications and databases will be running on the same server.

But each of these instances will be talking to one single Web API application to retrieve data from their database for that specific company.

My question is that I am wondering whether it is a good practice to change the database connection string in the Web API application based on the request origin? Or am I overlooking something?

Answer 1

Now I am wondering whether it is a good practice to change the database connection string in the Web API application based on the request origin?

It depends upon what you mean by "based upon the request origin." If you're referring to something that the client controls, such as an IP address, then what you're considering is likely a bad idea. Things controlled by the client are easily spoofed and are effectively an invitation for mischief.

On the other hand, if you're referring to something that isn't easily spoofed, such as a client authentication token, then what you're considering is fine.

I can't tell which architecture you're planning on using.

Option A

          +->Application
          |
 Web API+->
          |
          +->DB

Option B:

Application+->Web API+->DB

In either case, the general concept that you're grappling with right now is termed "authorization."

Authentication is a related concept, but refers to the client proving they are who they say they are. Typically authentication is done with passwords, certificates, tokens, etc....

Authorization is related to providing access to functionality based upon who the client authenticated as. Determining database connection strings based upon client authorization is a fairly typical case for authorization.

If you happen to be using Option A, then the Web API will determine DB and application access based upon the client's authorization privileges. And if you happen to be using Option B, then you'll need to make sure that the application passes along the authentication token into the Web API so it can determine the correct DB for access.

Answer 2

It is a bad idea to rely on anything the client provides for access control other than a shared secret that is difficult to spoof.

Request origin is easily spoofed.