Yes, it can be modified that way. In fact this article pre-dates the sasl auth feature in memcached. For a key prefix, you will need something that’s guaranteed to be unique, so be careful taking an approach like using a hash of the username. Also, you don’t want your key prefix to be too long, and at the same time you don’t want it to be too short, or it could be vulnerable to brute force attacks. The happy medium is probably in the 10 character range.

Keep in mind that having a little bit of cache is generally a LOT better than having no cache at all. I suggest having a separate memcached instance per application/developer, each running on a separate port on whatever server(s) you plan to run memcached on, and control each with sasl auth. Most web applications can see a significant benefit from having a cache in the 64 MB or smaller size range.

Keep in mind that if you use SASL on memcached, you are limited to using clients that support SASL (which means they must only use the binary protocol). The last time I looked there were only a small number of clients that implemented this support, so you will need to be sure that whatever client you plan to use supports these features.

I have hundreds of sites in a shared hosting configuration at a university. It’s a pretty decent setup, with several application front-ends. Most developers here are trustworthy. But, exploited code could endanger the memcache or expose the data it holds. I’d love to offer memcache to these developers. It’s just the security that holds me back.

Couldn’t the server be modified to append some string to each key (store and retrieve request) in order to isolate user data, while allowing all of campus to access a vast bucket of memory? It would be nice if memcached be provided with this identification prefix at startup. Here are a few values that might be offered as prefix options:

sasl user name
first octect of the client’s IP
first two octets, and so on

Of course, the flush and stats commands could be modified accordingly, also prepending these prefixes.

Thanks for your great question/request. You’re right that using the SASL support is the ideal way to solve the problem I had initially found when I produced this patch. There is more than one client library for PHP. The Memcache library is not based on libmemcached but the Memcached library is. As you noticed, neither implements the SASL features yet according to the v1.0.1 change log. It might be worth asking the author if he has plans to add that.

Cheers,

Adrian

SASL Authentication for Memcached: http://bit.ly/btQZef