-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 William,
On 1/14/2010 1:30 PM, WM C wrote: > In the data source declaration, database username, password needs to > be provided, and they are in plain text! > > For the application, data source works fine, but I feel it is really > not safe - anybody who can access the server can see the password, > plus the fact that the file need to be upload to a source control > repository - password becomes an open secret, if it's still a secret > :( If you are uncomfortable putting "secrets' under revision control, then just don't do it: make it a part of your deployment process to substitute-in the username and password into your configuration file. We do this on our project using Apache ant's <copy> command with filtering enabled. Our server.xml file has parameterized the DATABASE_USERNAME and DATABASE_PASSWORD "replacements" and so whenever we do a build, these values are substituted-in. There are others, too, like DATABASE_URL. This allows us to easily change credentials, switch databases, and even have multiple devs on a single machine running the same software pointing to different databases: just have a per-user config file that holds the credentials. - -chris -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAktQg3MACgkQ9CaO5/Lv0PAUOwCfemqtu+K68cHttRyETx7i+36D qOAAn1Jy8Czqlf8yAZUeHl1vqkLkufeb =Lh2k -----END PGP SIGNATURE----- --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
