Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
If I'm building an application that connects to a remote database, where should I hide the credentials?
I've seen many suggest that you go through a web-application and use POST and GET requests to communicate with the database through the web-app. Now the website should then have some sort of password. Where do I hide these credentials in my application?
You don't try to hide them. Anyone with access to the application and sufficient incentive will be able to find the credentials.
So what do you do instead? It all depends on what you're trying to restrict. If it's an app for anyone to download and use then you may not need any credentials. A step up from that would be to generate and store a security token after the enduser enters any required data (ie. registers). Or you can have the end user enter credentials that have been assigned to them (eg. a user name and password). The point is that each user/device gets a unique identifier that can be revoked if needed and if found by the user doesn't give them access to anything beyond what they already have access to through the app.
The reason using POST and GET are suggested is less about the authentication process and more about limiting and controlling what it is that the app can do. With a REST (or similar) interface you can program various validations of the data coming from the app and you can do it on a piece of hardware (the server) where you have full control. Using an interface like that also means you don't have to open up full access to the database as you would only program the functions your application actually needs.
