Is it safe to build REST API to capture data into a database?

Question

A user needs to send us data weekly or monthly and I need to capture that data into a database to present it on a website. However, I do not want the user to have direct access to the data base.

So I was thinking of building REST API and capture the data into a database that user sends (instead of responding back to the request).

I am new to this field and wondering if this is a safe practice? If there is a better way, please let me know. Thanks!

As an production example you can look on http://postgrest.com/ — Set, Jun 02 '16 at 14:17

score 0 · Answer 1 · answered Jun 02 '16 at 12:50

Yes, multi tier architecture is always safer than direct database access.

Just remember to "sanitize" your inputs to the database. In the case of SQL, read about SQL injection. If you are going to be displaying some information to a webpage, read about cross site scripting (XSS).

score 0 · Answer 2 · edited May 23 '17 at 10:34

0

You should also consider security for your REST API, especially if they are publicly available over the Internet.

Best practices for securing a rest api web service

edited May 23 '17 at 10:34

Community

1
1

answered Jun 02 '16 at 12:59

blur0224

972
8
26

score 0 · Accepted Answer · answered Jun 02 '16 at 14:05

0

Yes and as blur0224 said you should consider security for your REST API. I personnaly advise you to use a token based authentication (JWT, OAUTH2 etc...). So the user have to be authenticate and authorized to access your data base.

answered Jun 02 '16 at 14:05

EmCode

344
1
10

Is it safe to build REST API to capture data into a database?

3 Answers3