I'm an experienced programmer, but for the first time I'm developing an app that connects to a Postgres server over the
internet.
How do you secure the password used to connect to Postgres?
My idea is to have a single user, representing my app, defined in Postgres. Then separately I'll have my own table to
trackeach human user. I've learned about BCrypt and Postgres' encryption functions "crypt" etc. to securely store the
humanuser's password as a value in a row in my own "user_" table.
But how do I secure the app's password to connect to Postgres?
a) I assume I should encrypt the connection with SSL. I'm learning about SSL certificates now. Is that the way to go?
Wouldyou consider that to be required in any serious business app connecting to Postgres over the Internets?
b) Hard-coding the app's Postgres password in the app's source code seems less than ideal to me. Is there some better
way?
-- If the app is built in Java, I've heard that Java is very easy to de-compile and thus expose the password. Other
languagessuch as Real Studio (REALbasic) may be not suffer that vulnerability.
-- Hard-coding means I'm not free to change the password on the server. To change the password, I would have to upgrade
allmy users simultaneously.
c) Should I manage all my human users as Postgres users? Is trying to manage the passwords on my own a dumb idea?
--Basil
