Best way define important credentials in spring boot

Question

When using Spring Boot application we use different application.properties files according to different environments.

We put important credentials like: database configurations, server IPs, admin username/password and so on.

I am worrying about what would happen if someone would obtain our application properties and get all important details.

Is there any good approach to put important credentials somewhere and obtain them in our Spring Boot application based on environment?

How about using env variables to store these data and then get it in application properties using ${ENV_VAR_NAME} — Prashant, Jun 19 '18 at 12:55

score 10 · Accepted Answer · answered Jun 19 '18 at 13:09

10

Many techniques

Using tokens replacement (maven replacor)

application.properties spring.datasource.password=#MY_DB_PASSWORD#
tokens.properties #MY_DB_PASSWORD#=SECRET_PASSWORD

where tokens.properties has an access protection
Using environment variable
mvn spring-boot:run -Dspring.datasource.password=SECRET_PASSWORD

or simply
spring.datasource.password=${myDbPasswordEnv}
Using Jaspyt to encrypt your properties

answered Jun 19 '18 at 13:09

Halayem Anis

7,654
2
25
45

and where this tokens.properties would be ? Is this also in our application ? – Abhishek saini Jun 20 '18 at 06:38
`tokens.properties` can be anywhere while it has an access protection, for example in a GIT repository :) – Halayem Anis Jun 20 '18 at 07:46
okay thank you, but how do i define access protection in token.properties and how can i access it in my application .Can you please elaborate – Abhishek saini Jun 20 '18 at 12:15

score 2 · Answer 2 · answered Jun 19 '18 at 13:01

One solution is to use Environment variables and property placeholders in the application properties. Lets say, you want to store the password of the database. Create an environment variable:

setx DEV_DB_PASS <your_dev_database_password>

Now, in the application properties file, you can access this value as:

spring.datasource.password = ${DEV_DB_PASS}

You can refer to the official documentation.

score 1 · Answer 3 · answered Sep 22 '20 at 12:59

1

Please never think environment variables are hidden - The proc entry env has these owned by process owner. Security by obscurity does not help.

# ls -asl /proc/6475/environ 
0 -r-------- 1 karl karl 0 Sep 22 13:58 /proc/6475/environ

answered Sep 22 '20 at 12:59

Karl Royer

11
1

score 0 · Answer 4 · answered Jun 19 '18 at 12:46

0

You should use spring cloud config. As it is best suited for managing configuration in central place using git repository or any similar.

answered Jun 19 '18 at 12:46

Gaurav Srivastav

2,381
1
15
18

Best way define important credentials in spring boot

4 Answers4

Linked