CODEWITHSUNDEEP
mysqlsecurityphp-7
Broco
Broco

Reputation: 217

How to securely store a password to a mailserver in a web application

and no, I don't mean to store my users passwords encrypted, I use password_hash() for that. The thing is I want to send users E-Mails with PHPMailer and the E-Mail-credentials should be configurable through the web application and thus, stored on the server (basically the application has its own E-Mail-Account).

And if there is a best practice to store this information in the database, shouldn't I then also encrypt users e-mail addresses in the database so in case it gets corrupted, the intruder at least doesn't have a plain text list of mail addresses?

My other idea was to just write the credentials to a file, but is this considered to be more safe?

I'm using MariaDB, Apache2 and PHP7.

Edit: why does stackoverflow cut out my "Hello" at the beginning?

Upvotes: 0

Views: 85

Answers (1)

Bolovsky
Bolovsky

Reputation: 538

Usually this kind of passwords is stored in a file. It's opinionated, so take your own conclusions out of it, but you should have a file with read permissions for your web application in a non web reachable (pretty obvious, but prefer to state it) dir. Usually this file should be encrypted when out of the server (if you need to commit your pwd files, for some reason). And this policy is considered pretty safe.

At some point, you have a given pwd in plain text (e.g.: your DB password if probably in a config file), and honestly, gaining access to your DB is pretty much worse than getting access to your mail outbound server

Regarding the 2nd part, good practices dictate you should encrypt any sensitive information. You should be however aware that you cannot query encrypted data in sql (yet), so if you actually require this sensitive data to be 'findable', you need to take steps into that direction, which might unnecessarily increase the complexity of your application.

But as stated above, this is opinionated

Upvotes: 1

Related Questions