I'm attempting to link my Discord bot with a MySQL database that is on another server. However, this example is apparently insecure:

const mysql = require('mysql');
const connection = mysql.createConnection({
  host     : 'hostname',
  port     : 'portnum',
  user     : 'db_user',
  password : 'db_user_password',
  database : 'db_name',
  charset  : 'utf8mb4'
});

How would I go about establishing a (more) secure connection?

I'm attempting to link my Discord bot with a MySQL database that is on another server. However, this example is apparently insecure:

const mysql = require('mysql');
const connection = mysql.createConnection({
  host     : 'hostname',
  port     : 'portnum',
  user     : 'db_user',
  password : 'db_user_password',
  database : 'db_name',
  charset  : 'utf8mb4'
});

How would I go about establishing a (more) secure connection?

• javascript
• mysql
• node.js
• database
• discord.js

• 1 Your question is too broad to answer here. If you'd like to learn more about Javascript, I'd suggest Mozilla's guide. If you'd like to learn more about node, refer to its documentation. If you'd like to learn more about the mysql npm module, refer to its documentation. – Max Vu Commented Jun 3, 2019 at 23:06

3 Answers 3

If its a hosted database server and you have the secured endpoint URL (meaning https:// host) then just use that as the hostname host: 'hostname' and that should be enough.

If it's a private server that you own and you have the SSL certificates then you can use the following:

const fs = require('fs');
const mysql = require('mysql');

var connection = mysql.createConnection({
    host: '127.0.0.1',
    port: '3306',
    user: 'root',
    password: 'passw0rd',
    database: 'test',
    ssl: {
        ca: fs.readFileSync(__dirname + '/certs/ca.pem'),
        key: fs.readFileSync(__dirname + '/certs/client-key.pem'),
        cert: fs.readFileSync(__dirname + '/certs/client-cert.pem')
    }
});

connection.connect();

You can connect using SSL using something like this:

const fs = require('fs');
const mysql = require('mysql');
const connection = mysql.createConnection({
  host     : 'hostname',
  port     : 'portnum',
  user     : 'db_user',
  password : 'db_user_password',
  database : 'db_name',
  charset  : 'utf8mb4',
  ssl: {
      ca: fs.readFileSync(__dirname + '/certs/ca.pem'),
      key: fs.readFileSync(__dirname + '/certs/client-key.pem'),
      cert: fs.readFileSync(__dirname + '/certs/client-cert.pem')
  }
});

You must also enable SSL on the MySql server. There are some tutorials online showing how to, but you would need root access to do this.

It's not really insecure. You have a couple of options. First, are the servers on a private network behind a firewall? Or are they only able to connect with each other over public ip address? If the former is true, you are fine. I would however add firewall rules on the server so that it only allows connections from the other machine. If they are connecting on public IP addresses, you'll need to do the same and also use a non-standard port for MySQL. You can also add another NIC and bind the MySQL service to that. This way if hackers discover your server, it will appear to have all ports closed.