Impara Securing Sensitive Configuration Data | System Properties and Environment Variables

Securing sensitive configuration data is critical for any Java application. One of the most common pitfalls is accidentally committing secrets, such as database passwords or API keys, to version control systems like Git. When secrets are included in source code repositories, they may be exposed to anyone with access to the repository, including contributors, attackers who gain access, or even automated bots that scan public repositories for secrets. To avoid this, always ensure that configuration files containing sensitive data are excluded from version control using .gitignore or similar mechanisms. Instead, store secrets in environment variables, externalized configuration files with restricted permissions, or dedicated secret management tools.

Another risk is displaying or logging sensitive information during debugging or error handling. Even seemingly harmless debug logs can leak secrets if they print out full configurations or stack traces containing sensitive values. Always review log statements to ensure that no confidential data is written to logs or exposed in error messages.

EnvSecretDemo.java


              1234567891011121314
            
package com.example;

public class EnvSecretDemo {
    public static void main(String[] args) {
        String dbPassword = System.getenv("DB_PASSWORD");
        if (dbPassword == null) {
            System.out.println("Database password is not set in environment variables.");
        } else {
            System.out.println("Database password loaded from environment (value is NOT displayed for security).");
        }
        // Never log or print the actual password!
    }
}

To manage secrets securely in Java applications, follow these best practices:

Store secrets such as passwords, API tokens, and encryption keys in environment variables or dedicated secret stores;
Restrict file permissions on configuration files that contain sensitive data so that only the application process can read them;
Never hard-code secrets directly in your source code or properties files that are checked into version control;
Avoid logging or printing sensitive values, especially in production environments;
Rotate secrets regularly and remove any that are no longer needed.

By following these practices, you reduce the risk of accidental exposure and help ensure that sensitive configuration data remains protected.

MaskSensitiveConfig.java


              12345678910111213141516171819202122232425262728293031
            
package com.example;

import java.util.HashMap;
import java.util.Map;

public class MaskSensitiveConfig {
    public static void main(String[] args) {
        Map<String, String> config = new HashMap<>();
        config.put("db.user", "admin");
        config.put("db.password", "SuperSecret123");
        config.put("api.key", "abcdefg-12345");

        for (Map.Entry<String, String> entry : config.entrySet()) {
            String key = entry.getKey();
            String value = entry.getValue();
            if (isSensitiveKey(key)) {
                value = mask(value);
            }
            System.out.println(key + ": " + value);
        }
    }

    private static boolean isSensitiveKey(String key) {
        return key.toLowerCase().contains("password") || key.toLowerCase().contains("key");
    }

    private static String mask(String value) {
        return "****";
    }
}

1. What is a recommended way to store sensitive configuration values in Java applications?

2. Why should you avoid logging sensitive configuration data?

Tutto è chiaro?

Grazie per i tuoi commenti!

Sezione 2. Capitolo 4

Chieda ad AI

Chieda pure quello che desidera o provi una delle domande suggerite per iniziare la nostra conversazione

Scorri per mostrare il menu