<p>In the web-application I'm developing I currently use a naive solution when connecting to the database:</p>

<pre><code>Connection c = DriverManager.getConnection("url", "username", "password");
</code></pre>

<p>This is pretty unsafe. If an attacker gains access to the sourcecode he also gains access to the database itself. How can my web-application connect to the database without storing the database-password in plaintext in the sourcecode?</p>

[{'answer_id': 42838, 'author': 'Julio César', 'author_id': 2148, 'author_profile': 'https://Stackoverflow.com/users/2148', 'pm_score': 5, 'selected': True, 'text': '<p>You can store the connection string in Web.config or App.config file and encrypt the section that holds it. Here\'s a very good article I used in a previous project to encrypt the connection string:</p>\n\n<p><a href="http://www.ondotnet.com/pub/a/dotnet/2005/02/15/encryptingconnstring.html" rel="noreferrer">http://www.ondotnet.com/pub/a/dotnet/2005/02/15/encryptingconnstring.html</a></p>\n'}, {'answer_id': 42841, 'author': 'aku', 'author_id': 1196, 'author_profile': 'https://Stackoverflow.com/users/1196', 'pm_score': 1, 'selected': False, 'text': '<p>I can recommend these techniques for .NET programmers:  </p>\n\n<ul>\n<li>Encrypt password\\connection string in config file</li>\n<li>Setup trusted connection between client and server (i.e. use windows auth, etc)</li>\n</ul>\n\n<p>Here is useful articles from CodeProject:  </p>\n\n<ul>\n<li><a href="http://www.codeproject.com/KB/cs/Configuration_File.aspx" rel="nofollow noreferrer">Encrypt and Decrypt of ConnectionString in app.config and/or web.config</a></li>\n</ul>\n'}, {'answer_id': 42842, 'author': 'Jon Limjap', 'author_id': 372, 'author_profile': 'https://Stackoverflow.com/users/372', 'pm_score': 3, 'selected': False, 'text': '<p>In .NET, the convention is to store connectionstrings in a separate config file.</p>\n\n<p>Thereon, the <a href="http://odetocode.com/Blogs/scott/archive/2006/01/08/2707.aspx" rel="nofollow noreferrer">config file can be encrypted</a>.</p>\n\n<p>If you are using Microsoft SQL Server, this all becomes irrelevant if you use a domain account to run the application, which then uses a trusted connection to the database. The connectionstring will not contain any usernames and passwords in that case.</p>\n'}, {'answer_id': 42862, 'author': 'stjohnroe', 'author_id': 2985, 'author_profile': 'https://Stackoverflow.com/users/2985', 'pm_score': 1, 'selected': False, 'text': '<p>Unless I am missing the point the connection should be managed by the server via a connection pool, therefore the connection credentials are held by the server and not by the app. </p>\n\n<p>Taking this further I generally build to a convention where the frontend web application (in a DMZ) only talks to the DB via a web service (in domain), therefore providing complete separation and enhanced DB security. </p>\n\n<p>Also, never give priviliges to the db account over or above what is essentially needed.</p>\n\n<p>An alternative approach is to perform all operations via stored procedures, and grant the application user access only to these procs.</p>\n'}, {'answer_id': 42872, 'author': 'Andrew', 'author_id': 4394, 'author_profile': 'https://Stackoverflow.com/users/4394', 'pm_score': 1, 'selected': False, 'text': '<p>Assuming that you are using MS SQL, you can take advantage of windows authentication which requires no ussername/pass anywhere in source code.  Otherwise I would have to agree with the other posters recommending app.config + encryption.</p>\n'}, {'answer_id': 20749831, 'author': 'Neil McGuigan', 'author_id': 223478, 'author_profile': 'https://Stackoverflow.com/users/223478', 'pm_score': 1, 'selected': False, 'text': "<ol>\n<li>Create an O/S user</li>\n<li>Put the password in an O/S environment variable for that user</li>\n<li>Run the program as that user</li>\n</ol>\n\n<p>Advantages:</p>\n\n<ol>\n<li>Only root or that user can view that user's O/S environment variables</li>\n<li>Survives reboot</li>\n<li>You never accidentally check password in to source control</li>\n<li>You don't need to worry about screwing up file permissions</li>\n<li>You don't need to worry about where you store an encryption key</li>\n<li>Works x-platform</li>\n</ol>\n"}]
['https://Stackoverflow.com/questions/42833', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/4464/']