Is It Secure To Store Passwords In Web Application Source Code?

Question

So I have a web application that integrates with several other APIs and services which require authentication. My question is, is it safe to store my authentication credentials in plain text in my source code? What can I do to store these credentials securely?

I think this is a common problem, so I'd like to see a solution which secures credentials in the answers.

In response to comment: I frequently use PHP, Java, and RoR

I'd like to see some more votes for an answer on this question.

Answer 1

The only reason to NOT store the PW in the code is simply because of the configuration issue (i.e. need to change the password and don't want to rebuild/compile the application).

But is the source a "safe" place for "security sensitive" content (like passwords, keys, algorithms). Of course it is.

Obviously security sensitive information needs to be properly secured, but that's a basic truth regardless of the file used. Whether it's a config file, a registry setting, or a .java file or .class file.

From an architecture point of view, it's a bad idea for the reason mentioned above, just like you shouldn't "hard code" any "external" dependencies in your code if you can avoid it.

But sensitive data is sensitive data. Embedding a PW in to a source code file makes that file more sensitive than other source code files, and if that's your practice, I'd consider all source code as sensitive as the password.

Answer 2

It is not to be recommended.

An encrypted web.config would be a more suitable place (but note can't be used with a web farm)