Security issue.

Question

Security issue.

indyaah opened this issue 10 years ago · comments

As usual going through code (part of learning process) ended up looking into txt.txt which contains db connection string with credentials in it IN PLAIN STRING!!

You might want to look into that.

Duncan Winn · Answer 1 · Sun Jan 11 2015 12:14:44 GMT+0800 (China Standard Time)

Thanks, are you talking about password=JGq4DVRwcZzU-hq10n4U_JeSv4aEG9SQ

The beauty of Spring of spring security is that it will generate a temporary password in dev mode if you don't assign on. txt.txt was a dump during dev (left in error) but all passwords are temporary (I believe).

If I'm missing something please let me know.

Anuj Patel · Answer 2 · Mon Jan 12 2015 02:37:19 GMT+0800 (China Standard Time)

I understand that part but the credentials still work.

PS : Tried to smudge as much possible to show that the credentials still work.

Duncan Winn · Answer 3 · Fri Jan 23 2015 07:18:17 GMT+0800 (China Standard Time)

oh wow - ok thanks I'll take a look

Duncan Winn · Answer 4 · Fri Jan 23 2015 23:55:49 GMT+0800 (China Standard Time)

Ok, I think what happened is that I took a dump of the startup to do some debugging and the db connection string was written out - nothing to do with spring security.

I'm not a dba so I just blew away the db and provisioned a new one and re entered the data.

Thanks for the heads up. I think it should all be sorted now. If not please let me know else I'll close the issue.