title: Different ways to store a password variable in a Java web application?
body: <p>I have implemented a routine where when a user submits a form an email is sent to the administrator. For this I have used Java Mail API. And I setup a dummy account on Microsoft Outlook for sending out the emails. In the code I have hard-coded the password. I am concerned this will be a security issue when I host the webpage.</p>
  
  <p>Here is my code.</p>
  
  <p>I have written a private function:</p>
  
  <pre class="lang-java prettyprint-override"><code>private void getSession(){
      this.session = Session.getDefaultInstance(properties,  
      new javax.mail.Authenticator() {
          protected PasswordAuthentication 
          getPasswordAuthentication() {
              return new PasswordAuthentication("xxxxxxxxx@outlook.com", "xxxxx_password_xxx");
          }
      });
  }
  </code></pre>
  
  <p>In my public <code>execute()</code> method I call the <code>getSession()</code> method and generate the message.</p>
  
  <pre class="lang-java prettyprint-override"><code>public String execute() throws Exception {
       getSession();
       Message message = new MimeMessage(this.session);
       message.setFrom(new InternetAddress("xxxxxxxxxxxxx@outlook.com"));
       message.setRecipients(Message.RecipientType.TO, 
                            InternetAddress.parse("admins.email@xxxxx.com"));
       message.setSubject("Form submit notification");
       //...
  }
  </code></pre>
  
  <p>Is it secure to hard code the password in the session method when I host the web page?</p>
  
  <p>And if not, then some pointers to implement the alternatives.</p>
  
  <p>Thanks! </p>