1

Background

I know that we should not store passwords in String variables in Java/.Net (Should be stored in mutable objects such as char arrays). And When it comes to the UI aspects we do have Password field widgets and secure methods such as getPassword and SecureString objects.

Problem 1

When it comes to console applications(Java) we used to pass in the command arguments as a string array. So when we need to inject a password into the program, we need to break our fundamental rule with Strings. How we can Secure this scenario ?

Problem 2

I am working in a Java Spring MVC(REST) application and I need to pass in set of passwords upon the service starts. Following is the method I am using now for these injections.

@Value("${Password1}")
private String pwd1;

@Value("${Password2}")
private String pwd2;

And when I starting my service I need to inject my password as follows using gradlew and Vanilla spring properties.

gradlew bootrun -DPassword1=!@# -DPassword2=$%$

How can I secure these passwords ?

  • Why don't you believe you should ever store a password in a string? Are you mis-understanding advice to not store passwords hard-coded in strings? – Boycott SE for Monica Cellio Feb 11 '17 at 17:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.