Is there is any way to protect the password in .xml using spring

Question

Is there is any way to protect database password in -servlet.xml file using spring

<bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">
  <property name="driverClassName"><value>com.mysql.jdbc.Driver</value></property>
  <property name="url"><value>jdbc:mysql:///BUSINESS</value></property>
  <property name="username"><value>root</value></property>
  <property name="password"><value>password</value></property>    
 </bean>

Answer 1

Built-in, no. But you can check this blogpost which shows how to extend the DataSource to provide AES encryption of the passwords.

Another approach might be to extend PropertyPlaceholderConfigurer and handle the AES (or RSA) encryption of the properties.

However, as noted in the comments of the linked blogpost, having the cipher key stored in the same file does not add significant security - it only adds obfuscation. So in both approaches above you have to obtain the AES/RSA key from another location, possibly accessible only for the user under which your application server is started (this has to do with OS security).

Answer 2

The approach often taken for this is to have the password stored in an external properties file on the production machine. Access to this file can then be restricted.

See here for how to configure the spring part of this:

http://stackoverflow.com/questions/1311360/property-placeholder-location-from-another-property