Question

I have a stored procedure that retrieves sensitive information from an SQL Server 2008 database. I would like to modify the procedure so that any time it is called, it records information about who called it in a separate table.

I thought something like the following would work:

declare @account varchar(255);
set @account = (SELECT SYSTEM_USER);

INSERT into AUDIT_LOG(ACCOUNT, TSTAMP)
VALUES(@account, getdate())
;

--Now fetch data
SELECT x,y,z from sensitive_info;

My issue is that the client application can issue a call to this stored procedure and get the sensitive information, but not commit the connection and the INSERT never occurs!

Is there some way to force the INSERT to happen before the SELECT?

I am using SQL Server 2008.

Thanks,
Carl

Answer 1

You only COMMIT if a transaction has been started.

So you can test for an open transaction first and disallow the read. This will ensure that no transaction is open to be rolled back. I’ve used XACT_STATE() here

Using SET XACT_ABORT ON and TRY/CATCH too will mean that the INSERT for logging must happen too before the read happens. Any errors at all on INSERT will go to the CATCH block. So no read and the logging fail can itself be logged too.

So: this is your guarantee of “read only if logged”

Having an explicit transaction doesn’t help: the INSERT is an atomic action anyway. And if the called opens a transaction the log entry can be rolled back

CREATE PROC getSecretStuff
AS
SET NOCOUNT, XACT_ABORT ON;

BEGIN TRY
    IF XACT_STATE() <> 0
       RAISERRROR ('Call not allowed in an active transaction', 16, 1)

    INSERT into AUDIT_LOG(ACCOUNT, TSTAMP)
    VALUES(SYSTEM_USER, getdate());

    --Now fetch data
    SELECT x,y,z from sensitive_info;

END TRY
BEGIN CATCH
    --     error handling etc
END CATCH
GO