CODEWITHSUNDEEP
javaspringsecuritycredentialspassword-protection
Zerg
Zerg

Reputation: 789

Proper way of hiding very sensitive credentials in a web application

I am currently developing a spring boot web application. It is a REST api proxy that connects to another api using some very sensitive credentials. The credentials are hard-coded at the moment, but obviously they should not be. What is the proper way of hiding them?

I have considered using some library, like jasypt to encode them and put the encoded values in a properties file, with the key hidden somewhere, perhaps in system variable, (but it is just another layer of obfuscation, isn't it?)

How can I properly hide these sensitive credentials?

Upvotes: 0

Views: 921

Answers (2)

Stephen C
Stephen C

Reputation: 718678

The fundamental problem is that if you ever need to hold security credentials in the clear in the memory of a computer program, AND there are people who have the equivalent of "root" access to the machine, then it is possible for one of those people to gain access to the credentials.

So you need to design your security so that that the credentials never need to be held in the server's memory.

If you are really serious about solving this, you need to investigate Hardware Security Modules. However, the HSM approach is going to be complicated and expensive, and may require you to rework your authentication protocols.

Upvotes: 2

alexey28
alexey28

Reputation: 5210

You can use your server environment to hide your properties. Just store on your production server application.properties with real credentials and protect access, so only your application will have access to the property file.

Upvotes: 3

Related Questions