Secure Database Credentials in Java Web Apps

TL;DR

Database usernames and passwords should never be hardcoded directly into your web application’s code (like JSP pages). This guide shows you how to securely store and access database credentials using environment variables or a configuration file, preventing exposure of sensitive information.

Solution Guide

1. Understand the Risk: Hardcoding credentials in files like JSPs means anyone with access to those files (or even through a web application vulnerability) can see your database login details. This is a major cyber security risk.
   • Compromised Credentials: Attackers can gain full control of your database.
   • Compliance Issues: Many regulations require secure storage of sensitive data.
2. Option 1: Using Environment Variables

   Environment variables are a safe way to store configuration information outside of your application code.

   • Set the Environment Variables: On your server, set environment variables for your database credentials. The exact method depends on your operating system and server setup (e.g., using export in Linux/macOS or setting System Properties in Windows). For example:

     export DB_USERNAME=myuser
     export DB_PASSWORD=mypassword
     export DB_URL=jdbc:mysql://localhost:3306/mydb

   • Access the Variables in your Java Code (JSP): Read the environment variables within your JSP page.

     <% String dbUsername = System.getenv("DB_USERNAME");
        String dbPassword = System.getenv("DB_PASSWORD");
        String dbUrl = System.getenv("DB_URL"); %>

3. Option 2: Using a Configuration File

   A configuration file (e.g., properties file) stores settings separately from your code.

   • Create a Configuration File: Create a file (e.g., dbconfig.properties) to store the credentials.

     db.username=myuser
     db.password=mypassword
     db.url=jdbc:mysql://localhost:3306/mydb

   • Secure the File: Ensure this file is not accessible directly from the web (e.g., place it outside of your web application’s document root). Permissions should restrict access to only necessary users.
   • Read the Configuration File in Java Code (JSP): Use Java code to read the properties file.

     <%@ page import="java.util.Properties" %>
     <% 
      Properties props = new Properties();
      java.io.FileInputStream fis = null;
      try {
        fis = new java.io.FileInputStream("/path/to/dbconfig.properties"); // Replace with actual path
        props.load(fis);
        String dbUsername = props.getProperty("db.username");
        String dbPassword = props.getProperty("db.password");
        String dbUrl = props.getProperty("db.url");
      } catch (Exception e) {
        e.printStackTrace(); // Handle exceptions properly in production!
      }
      %>

4. Important Security Considerations:
   • Never Commit Credentials to Version Control: Do not include configuration files containing credentials in your Git repository or any other version control system. Use a .gitignore file to exclude them.
   • Encryption (Advanced): For highly sensitive environments, consider encrypting the configuration file and decrypting it at runtime.
   • Principle of Least Privilege: Grant database users only the minimum necessary permissions.
   • Regular Audits: Regularly review your security practices and configurations.