Check for read-only connection string for the reporting module

[jokob]

A security check for read-only connection string for the reporting module

[ondrejsevcik]

Hi @jokob, interesting idea. How would you implement that?

[jokob]

I'd Simply check if there is another connection string in the web config and if it's used for the reporting module. It would be too difficult to check the actual permissions, but this already gives us an idea if they've thought of setting it up in the first place.

[petrsvihlik]

Just a note - we'd have to check both settings and reports as the connection string can be defined on both levels. Is it safe to assume that, when there is a second connection string in the web.config that is used by at least one report, security matters have been taken into consideration and the result should be "Good"?

[jokob]

I think it would be a good pointer. But mostly, If there would be only one connection string it would automatically mean they didn't take care of this configuration...

[petrsvihlik]

Do you suggest checking just for existence of another connection string?

[jokob]

Yes, why not...if there is only one that means there definitely isn't a read only one for reporting