应用程序连接到数据库 [英] application connect to database

问题描述

我正在开发一个将被学校使用的应用程序。每个学校将建立他们的数据库。每个学校将向应用程序提供他们自己的设置文件。设置文件将包含提供设置文件的特定学校的数据库URL。这是为了让使用应用程序的学生可以加载不同的设置文件，如果他们想要连接到不同的数据库。

我的问题是，我如何保护用于连接到数据库的用户名和密码？因此，只有应用程序具有对数据库的读取和写入访问权限。

如果您需要更多信息，请与我们联系。

感谢

解决方案

查看 Jasypt ，它是一个java库，它允许开发人员以最小的努力为他/她的项目添加基本加密功能，而不需要对密码操作有深入的了解。 / p>

如果您使用Spring，您可以将 db.properties 定义为：

  jdbc.driver = com.mysql.jdbc.Driver 
 jdbc.url = jdbc：mysql：// localhost / yourdb 
 jdbc。 username = userName 
 jdbc.password = ENC（A6L729KukPEx7Ps8didIUWb01fdBRh7d）
  

并使用Jasypt Spring as：

 < bean class =org.jasypt.spring.properties.EncryptablePropertyPlaceholderConfigurer> 
< constructor-arg> 
< bean class =org.jasypt.encryption.pbe.StandardPBEStringEncryptor> 
< property name =config> 
< bean class =org.jasypt.encryption.pbe.config.EnvironmentStringPBEConfig> 
< property name =algorithmvalue =PBEWithMD5AndDES/> 
< property name =passwordEnvNamevalue =APP_ENCRYPTION_PASSWORD/> 
< / bean> 
< / property> 
< / bean> 
< / constructor-arg> 
< property name =locations> 
< list> 
< value> classpath：/META-INF/props/db/db.properties< / value> 
< / list> 
< / property> 
< / bean> 
 
< bean id =dataSourceclass =org.apache.commons.dbcp.BasicDataSource> 
< property name =driverClassNamevalue =$ {jdbc.driverClassName}/> 
< property name =urlvalue =$ {jdbc.url}/> 
< property name =usernamevalue =$ {jdbc.username}/> 
< property name =passwordvalue =$ {jdbc.password}/> 
< / bean> 
  

这将隐藏实际密码（您可以对用户名），因此他们无法从查看属性文件导出连接字符串。

如果您不使用春天，这里是一个 Jasypt指南来修改相同的手动

I am working on an application that will be used by schools. Each school will set up their on database. And each school will provide their own "settings" file to the application. The settings file will contain the database url for the specific school who made the settings file. This is so that a student using the application can just load a different settings file if they want to connect to a different database.

My question is, how do i protect the username and password used to connect to the database? So, that ONLY the application has read and write access to the database. And the application has read and write access to only that specific school?

If you need more information, please let me know.

Thanks

解决方案

Take a look at Jasypt, it is a java library which allows the developer to add basic encryption capabilities to his/her projects with minimum effort, and without the need of having deep knowledge on how cryptography works.

In case you use Spring, you can define your db.properties as:

 jdbc.driver=com.mysql.jdbc.Driver
 jdbc.url=jdbc:mysql://localhost/yourdb
 jdbc.username=userName
 jdbc.password=ENC(A6L729KukPEx7Ps8didIUWb01fdBRh7d)

and configure it with Jasypt and Spring as:

<bean class="org.jasypt.spring.properties.EncryptablePropertyPlaceholderConfigurer">
   <constructor-arg>
     <bean class="org.jasypt.encryption.pbe.StandardPBEStringEncryptor">
       <property name="config">
         <bean class="org.jasypt.encryption.pbe.config.EnvironmentStringPBEConfig">
           <property name="algorithm" value="PBEWithMD5AndDES" />
           <property name="passwordEnvName" value="APP_ENCRYPTION_PASSWORD" />
         </bean>
       </property>
     </bean>
   </constructor-arg>
   <property name="locations">
     <list>
       <value>classpath:/META-INF/props/db/db.properties</value>
     </list>
   </property>   
</bean>

<bean id="dataSource" class="org.apache.commons.dbcp.BasicDataSource">
    <property name="driverClassName" value="${jdbc.driverClassName}"/>
    <property name="url" value="${jdbc.url}"/>
    <property name="username" value="${jdbc.username}"/>
    <property name="password" value="${jdbc.password}"/>
</bean>

This would hide the actual password (you can do the same for the username) from students, so they would not be able to derive the connection string from looking at the properties file.

In case you are not using Spring, here is a Jasypt guide to achive the same "manually"

这篇关于应用程序连接到数据库的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！