Users and privileges
A MySQL account includes its host
Match an account to the real connection source and use specific remote hosts with TLS instead of normalizing the percent wildcard.
8 minute lesson
~~~
MySQL treats 'notes_app'@'localhost' and 'notes_app'@'10.0.0.24' as different accounts. Always write the full account name in CREATE USER, GRANT, SHOW GRANTS, and REVOKE.
Use localhost when the application and MySQL share a machine. For a remote application, use its specific private host or network pattern and require TLS:
CREATE USER 'notes_app'@'10.0.0.24'
IDENTIFIED BY 'replace-with-a-generated-secret'
REQUIRE SSL;The % host wildcard accepts every source host. Do not use it as the normal fix for a failed connection. Check DNS, network rules, TLS, and the real application source first.
Lesson completed