Is there any danger in granting SUPER privileges to a user?

Question

I had problems in restoring procedures in my db, so what I did was to grant SUPER privileges to my dbuser.

This user is the same user used in my web application, so I would like to know if there is any danger in granting SUPER privileges to a user.

Answer 1

It is always a bad idea to give a user more access than it needs to perform its duties.

This user is the same user used in my web application

If your application is hacked due to a bug in your code or one of the libraries/modules that you are using, the attacker may end up being able to take action as this user - so if this user has privileges that allow the complete destruction of the application database and other databases on the same server then a successful attacker gets these dangerous privileges too.

An application user should have the absolute minimum privileges that it needs to act on behalf of normal tasks required by the application. For larger systems it is not uncommon to have multiple application users for different parts of the system each with restricted rights that block them from interacting with unrelated objects in the database. Other privileges that allow management of the database and server more generally should be give only to separate administration users.

If you are in a situation where an application user needs administrative privileges then it is recommended that you try refactor your design to remove such need (or limit it as much as is possible).

Lookup the Principal of Least Privilege (i.e. https://en.wikipedia.org/wiki/Principle_of_least_privilege) for more information about why this is a good idea generally.

Answer 2

As the documentation reads:

The SUPER privilege enables an account to use CHANGE MASTER TO, KILL or mysqladmin kill to kill threads belonging to other accounts (you can always kill your own threads), PURGE BINARY LOGS, configuration changes using SET GLOBAL to modify global system variables, the mysqladmin debug command, enabling or disabling logging, performing updates even if the read_only system variable is enabled, starting and stopping replication on slave servers, specification of any account in the DEFINER attribute of stored programs and views, and enables you to connect (once) even if the connection limit controlled by the max_connections system variable is reached.

and I think we have seen a lot of with-power-comes-responsibility thing! Do you know SUPER grant has made them introduce a new variable to avoid accidents -> super_read_only.

So if you think "dbuser" shouldn't do what SUPER user can do, revoke it. Ideally you should give the least priv.