2

I'm wondering if it's possible to reduce the database user privileges required by Craft, to run just the front-end of the site.

Currently, the requirements docs indicate that the MySQL user must have CREATE, ALTER, DROP privileges, etc. This makes sense when using the CP to update content, etc. (or if the site needs to accept user input form submission, member login, etc.)

However, I'd like to disable the CP on the site front-end and create a multi-environment config using a DB connection with a much less privileged MySQL user.

Does Craft require more than basic database 'read' permissions to simply serve up content?

Any reason I couldn't create two subdomains, one for serving content and one for managing content via the CP and provide different DB users (with separate privileges)?

Thanks!

Improve this question

1 Answer 1

Reset to default
4

Short answer, no. You'll want to make sure that your DB user has all of the necessary privileges.

Just because you're not entering your data into the database doesn't mean that Craft isn't writing its own data into the database. There are several tables responsible for handling data which is automatically generated by Craft, and not managed directly by admins.

For example:

  • craft_sessions records user sessions, to know who is currently logged in.
  • craft_assettransformindex saves any image transforms which have already been triggered.
  • craft_templatecaches, craft_templatecachecriteria, and craft_templatecacheelements store data from templates which use the {% cache %} tag.

And there are probably others that I'm missing.

Bottom line... Craft needs to be able to write to the database just as much as you do.

Improve this answer
2
  • Thanks Lindsey, I'm not surprised that INSERT, UPDATE, and possibly DELETE(?) privileges are required. still wondering whether CREATE, ALTER, and DROP are needed? And, given that, how much of a difference it might make, from a security perspective?
    – Brett Gullan
    Commented Oct 31, 2014 at 9:39
  • 1
    Well, I'm guessing that CREATE, ALTER, and DROP are really only necessary if/when you run an update to Craft, or an update to any of your plugins. Either of those actions could trigger migrations, which need full capabilities to add, edit, or remove existing tables or columns. (It's possible that I'm overlooking something, but I'm 90% confident saying this.)
    – Lindsey D
    Commented Oct 31, 2014 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.