🚀 go-pugleaf

I am not familiar with that implementation but servlets should *not* be
accessible from casual http users, obviously.  Just because the servlet
engine needs access to the servlet classes doesn't not mean that the web
server should grant read access to the world for the servlet classes.

If that is really the case, I would look for another way to run the
servlets.

If that is not possible, put secure information in a file in a secured
directory, and read the data into memory when the servlet is inited.
Obviously that opens up even another security hole, which is no worse then
putting plain text passwords into Java source code, though.

Steve

<eherebonus@my-deja.com> wrote in message
news:8608ne$2ii$1@nnrp1.deja.com...
> I am using Apache Jserv for servlet engine, my servlet will access
> databases on the web server, so I have to program the database login
> and password into the servlet! The problem: is this secure? Since the
> servlet directory has to be readable and execuable, some strangers can
> just get the servlet class, decompile it, and get the login/password
> for my database?
>
> Any response will be appreciated.
>
>
> Sent via Deja.com http://www.deja.com/
> Before you buy.

Please get back to me if you ever manage to download the .class file of
a servlet (kept in the servlet directory of the web-server) from a
browser. 

You cannot!

But since you insist, here is another solution: you can store the
username/passsword in a text file, which is kept in some path not
accessible via the web server but readable by the servlet (in Unix you
ought to take care of this). 

Cheers, 
Sachin

eherebonus@my-deja.com wrote:
> 
> I am using Apache Jserv for servlet engine, my servlet will access
> databases on the web server, so I have to program the database login
> and password into the servlet! The problem: is this secure? Since the
> servlet directory has to be readable and execuable, some strangers can
> just get the servlet class, decompile it, and get the login/password
> for my database?
> 
> Any response will be appreciated.
> 
> Sent via Deja.com http://www.deja.com/
> Before you buy.

-- 
+----------------------------------------------------+
                    Sachin Hamirwasia 
               Hall 9, Room #45-1-849, NTU 
             Nanyang Avenue,  SINGAPORE 639798
                  Phone: 7927605(Room)

Email : sachinh@singnet.com.sg
Web site : http://www.singnet.com.sg/~sachinh