数据库密码存储问题，Java Web App

Question

I'm part of a Java Spring Web app which should be very secure. So far, on test environment we're loading database username & password from a property file which lies on classpath. The password is encrypted with a key which we load from local file system.

My job is to find a better way(more secure one) using software tools only. I was thinking about supplying the db username and password on startup of webapp or smth like that(But still does not seem ok because the DB admin should be present on startup). Other than that I'm stuck.

What is the best way to deal with this issue?

Answer 1

You need to lock down the database so that only the app can talk to it with minimal creds as possible.

One way is restrict it so that only app servers private IP is only accepted. Make it so the database only listens to private (internal) network connections.

The password is a red herring.