Forum Academy Marketplace Showcase Pricing Features

Login form where user info is in SQL

Hi,
Do you know a way to create a login and sign up button where the user info (email / password) is stored in external SQL database?

Anybody has any idea how to do this? Or do I need to run sql query in sql connector and use username and password as parameter, if query result is none then user can’t login?i

Security issues aside, yes I think you would have to run a query to get the userid and password and then run the logon workflow using that data.

Thanks NigelG and do you know any instructions on how to run logon workflow using sql query? The training video shows how to build a log on page but didn’t show how to do it using sql query.

Regarding the security issue, would the sql statement in the sql connector may introduce some risk?

Thanks

The connection established between Bubble’s server and the SQL database is via HTTPS, so probably secure enough for what you want.

On the other hand, storing logins and passwords in a database without encryption is generally considered a high security risk. They’re accessible by anyone who has admin access to the database, plus potentially anyone with a valid login to the database, depending on table permissions.

Yes, as @mishav says it is storing it in clear that is a big risk.

What you could do is store the hashed and salted password and then use a Web service (which contains the hash key) to convert. I have looked at Dovecot for this, and will probably implement it in a few months time.

This is beyond my knowledge :slight_smile: This hashed password is a fake password then being converted through web service? where does this fake password stored? in bubble’s database?

@emmanuel, how would you recommend this if I want to store the login credential in external sql database?

Is there any documentation step by step on how to do this?

You can think of a hash as like taking a password and putting it in a blender, then storing a sample of the paste. You can’t get the original password back, but if you put an identical password through the same blender, you’ll get an identical bit of sample paste. A different password is highly unlikely to produce the same tasting paste - “there’s something a bit off about this flavour”.

Bubble already has a decent mechanism, so they’re unlikely to recommend you roll your own unless you know how to test it thoroughly : )