如何存储Java Web应用程序所需的密码？

Question

I have read several topics about this situation and found some solutions, but I´m not quite sure if they fit for my project.

For example this topic: https://stackoverflow.com/questions/10306673/securing-a-password-in-a-properties-file

In my web application a user can register and do stuff on my homepage, where he has to be logged in. I´m saving the password with SCrypt. The user can log in by typing in the password in clear text, the password gets checked against the encrypted password in the database. If the password is correct, then the user has access to the control center.

Registered AND non registered users can send emails to my e-mail account with a contact form.

This contact form calls a Bean, which sends an email. To send this E-Mail I have to store the account information somewhere.

The problem is, that I have to get the password decrypted. If I save the information encrypted the account validation fails.

Saving the password in plain text is absolute horror.

I thought about setting the passwords into a property in an application scoped bean after the application has started, but I´m not sure if this is a save way.

Another option is a file, which the application reads from, if the password is needed. But in this file the password is decrypted.

What is the best way to save a password, which is needed by the application?

EDIT1 06.04.2016 12:48:

I need the password decrypted for my EmailBean, so the bean can login into my e-mail account and send the message.

Answer 1

Well, if you need the password to auth against your mail server, you need it in plaintext somewhere. If you do not lift the requirement to have the password, eg by configuring your mail server to accept mails from your IP without password, then the best you can do is to obfuscate the password by some encrypting. But it has to be something reversible and your code will reverse it. So if someone breaks into the system and has access to your code, he will also be able to decrypt and retrieve your password. But at least it will not be in plaintext in the file.