Security Practices and Solutions
View All Tags
Access denied for user 'inventory_app'@'localhost'. Account is locked. is unusually clear: the password isn't the problem, the account is switched off. One thing I didn't expect: sessions that were already connected kept working.
Authentication requires secure connection comes from how MySQL's default sign-in works: the first time it checks a password, it needs an encrypted connection to do it safely. Connecting over TCP with TLS turned off gets you this error, and the same command worked a minute later, which threw me at first.
Your password does not satisfy the current policy requirements means the validate_password component is on, and it doesn't like this password. The message doesn't say why, but the rules are one query away.
ERROR 1142 (42000): DROP command denied to user means the account you're signed in with doesn't have that right on that table. If the account belongs to an app, that's often exactly what you want. And TRUNCATE gives the same message, which surprised me.
error 79 at 1 depth lookup: invalid CA certificate means the certificate you're checking is fine, and the problem is one level up: the CA that signed it isn't marked as a CA. Mine had lost its CA:TRUE because I'd run openssl with no configuration file.
A package can be fine the day you add it and have a published security advisory the next month. .NET checks for that on its own, every time it restores packages, and dotnet package list --vulnerable gives you the full report on demand. This guide runs both on a clean solution, adds a package version with a known vulnerability, reads the report, and moves it to a safe version.
Every .NET C# app that talks to MySQL starts with a connection string: one line that says where the server is, which database to use, who you are, and how to protect the connection. This guide builds one for Oracle's MySql.Data driver, which EF Core's MySql.EntityFrameworkCore provider also uses, explains each key with its documented default, and tests it with a small C# program that tells you exactly how it connected.
error NU1903: Warning As Error: Package 'Newtonsoft.Json' 12.0.3 has a known high severity vulnerability, https://github.com/advisories/GHSA-5crp-9r3c-p9vr NuGet's built-in audit found a published security advisory for a package version the project uses, and because warnings were errors, restore stopped. The fix is one version change. Getting there took me two failed attempts first, and both are worth knowing.
Retrieval of the RSA public key is not enabled for insecure connections is one of the most confusing MySQL errors in .NET, because it comes and goes: the same connection string fails after MySQL restarts and works again later. The cause is MySQL's default sign-in method, caching_sha2_password, meeting a connection without TLS. This post shows it happening in a small .NET C# program, explains why it's intermittent, and fixes it the right way.
A connection string usually contains a password, and appsettings.json is committed to Git with the rest of your code. .NET's Secret Manager, the dotnet user-secrets command, keeps secrets in a file in your user profile instead, and ASP.NET Core reads them as if they were in appsettings.json. This guide stores a MySQL connection string that way, shows every command with its real output, and explains how the same setting reaches the app outside development.
