🚀 go-pugleaf

I am not familiar with that implementation but servlets should *not* be
accessible from casual http users, obviously.  Just because the servlet
engine needs access to the servlet classes doesn't not mean that the web
server should grant read access to the world for the servlet classes.

If that is really the case, I would look for another way to run the
servlets.

If that is not possible, put secure information in a file in a secured
directory, and read the data into memory when the servlet is inited.
Obviously that opens up even another security hole, which is no worse then
putting plain text passwords into Java source code, though.

Steve

<eherebonus@my-deja.com> wrote in message
news:8608ne$2ii$1@nnrp1.deja.com...
> I am using Apache Jserv for servlet engine, my servlet will access
> databases on the web server, so I have to program the database login
> and password into the servlet! The problem: is this secure? Since the
> servlet directory has to be readable and execuable, some strangers can
> just get the servlet class, decompile it, and get the login/password
> for my database?
>
> Any response will be appreciated.
>
>
> Sent via Deja.com http://www.deja.com/
> Before you buy.