title: Best practice to store password in xml security-context.xml or database?
body: <p>Good day developers.
  I have question. In my web application I use spring security. I have 2 simple ROLE: User, Admin. For each of those rules I have his own password because the all have different access to my web-app. So I store all passwords now in security.xml in sha-256 hash encoding: </p>
  
  <pre><code>    &lt;security:http pattern="/search" security="none" /&gt;
  
      &lt;security:http auto-config="true" &gt;
  
      &lt;security:session-management session-fixation-protection="migrateSession"/&gt;
  
      &lt;security:intercept-url pattern="/input" access="ROLE_ADMIN, ROLE_USER"/&gt;
      &lt;security:intercept-url pattern="/delete" access="ROLE_ADMIN"/&gt; 
  
      &lt;security:form-login login-page="/login" 
                           authentication-failure-url="/loginfail"
                           default-target-url="/input" 
                           always-use-default-target="true" 
                           username-parameter="j_username"
                           password-parameter="j_password" /&gt;
  
      &lt;security:logout logout-success-url="/logout"/&gt;
  
          &lt;security:session-management&gt;
              &lt;security:concurrency-control max-sessions="1" error-if-maximum-exceeded="true" /&gt;
          &lt;/security:session-management&gt;
  
      &lt;/security:http&gt;
  
  
      &lt;security:authentication-manager&gt;
      &lt;security:authentication-provider&gt;
      &lt;security:password-encoder hash="sha-256"/&gt;
      &lt;security:user-service&gt;
      &lt;security:user name="user" password="04f8996da763b7a969b1028ee3007569eaf3a635486ddab211d512c85b9df8fb" authorities="ROLE_USER"/&gt;
      &lt;security:user name="admin" password="8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918" authorities="ROLE_ADMIN"/&gt;
      &lt;/security:user-service&gt;
      &lt;/security:authentication-provider&gt;
      &lt;/security:authentication-manager&gt;
  </code></pre>
  
  <p>Does it really good idea? Maybe it is required to store them just in DB(H2 for example) for more protection. </p>
  
  <pre><code>&lt;bean id="dataSource" class="com.mchange.v2.c3p0.ComboPooledDataSource"&gt; &lt;!-- Using and configuring C3P0 proxy --&gt;
          &lt;property name="driverClass"&gt;&lt;value&gt;org.h2.Driver&lt;/value&gt;&lt;/property&gt;
          &lt;property name="jdbcUrl"&gt;&lt;value&gt;jdbc:h2:/home/vadim/workspace-sts-3.1.0.RELEASE/h2/EDUCATION&lt;/value&gt;&lt;/property&gt;
          &lt;property name="user"&gt;&lt;value&gt;sa&lt;/value&gt;&lt;/property&gt;
          &lt;property name="password" &gt;&lt;value&gt;&lt;/value&gt;&lt;/property&gt;
          &lt;property name="initialPoolSize"&gt;&lt;value&gt;3&lt;/value&gt;&lt;/property&gt; &lt;!-- Number of Connections a pool will try to acquire upon startup --&gt;
          &lt;property name="minPoolSize"&gt;&lt;value&gt;1&lt;/value&gt;&lt;/property&gt; &lt;!-- Minimum connection pool size --&gt;
          &lt;property name="maxPoolSize"&gt;&lt;value&gt;20&lt;/value&gt;&lt;/property&gt; &lt;!-- Max connection pool size --&gt;
          &lt;property name="maxConnectionAge"&gt;&lt;value&gt;3600&lt;/value&gt;&lt;/property&gt; &lt;!-- Set max connection age to 1 hour, after it will release --&gt;
          &lt;property name="maxIdleTime"&gt;&lt;value&gt;600&lt;/value&gt;&lt;/property&gt; &lt;!-- 10 minutes connection can stay unused before be discarded --&gt;
          &lt;property name="checkoutTimeout"&gt;&lt;value&gt;200000&lt;/value&gt;&lt;/property&gt; &lt;!-- Each what time check for unused connections --&gt;
          &lt;/bean&gt;
  </code></pre>
  
  <p>Now my password is blank, but I should have one. How to protect it??</p>
  
  <p>Thank you.</p>