独立Java应用程序中的PostgreSQL安全连接

Question

I'm creating standalone application (GUI-based on Swing). It will be like password holder (eg login / passwords for user specified sites)

It connects to remote psql database. And connection to the database stores in db.properties files.

What I would like:

1. How could I 'hide' database connection from user who will unarchive my .jar package? (in worst case at least the password of the connecting user)
2. Is there any way to prevent decompiling / debugging the file?

Answer 1

I recommend storing the DB credentials in an environment variable and having the source code read in the value.

This prevents having to store the credentials in source control or binaries but allows you to easily provision/change your secrets.

This has become a best practice included in "12 factor apps" and models the way Heroku and other hosting services manage application level config.