PostgreSQL secure connection in standalone java application

Question

I'm creating standalone application (GUI-based on Swing). It will be like password holder (e.g. login / passwords for user specified sites)

It connects to remote psql database. And connection to the database stores in db.properties files.

What I would like:

How could I 'hide' database connection from user who will unarchive my .jar package? (in worst case at least the password of the connecting user)
Is there any way to prevent decompiling / debugging the file?

Winfield · Accepted Answer · 2013-02-04 18:54:38Z

1

I recommend storing the DB credentials in an environment variable and having the source code read in the value.

This prevents having to store the credentials in source control or binaries but allows you to easily provision/change your secrets.

This has become a best practice included in "12 factor apps" and models the way Heroku and other hosting services manage application level config.

answered Feb 4, 2013 at 18:54

Winfield

19.2k4 gold badges55 silver badges65 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Gustavo Straube Over a year ago

I'm reading 12 factor docs right now and I agree with you, but there is no security concern in make my database access' data become env vars?

Winfield Over a year ago

Your application server must possess the database access credentials to run your application. Environment variables are no more or less secure than being stored on disk in a file. The best way to secure the database is to create a database user account with least privileges for the application to use.

Collectives™ on Stack Overflow

PostgreSQL secure connection in standalone java application

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related