hide string <property name="password" value="***"/> when public on GitHub?

Question

How I can hide string from my mvc-dispatcher-servlet.xml, when I public code on GitHub?

I can't exclude this file - it contain many important settings!

Answer 1

In my opinion your best bet is to use O/S environment variables for such things. That's what Heroku does, and they are a-ok.

Reasons:

• cross-platform
• easily read by many programming languages
• only user or root can read
• survives reboot
• never check passwords into source control by accident
• easy to have different config on different machines without editing any files

If you use a <context:property-placeholder /> in your spring app context config then Spring can read O/S env vars like $USERNAME

You might have to restart your IDE after changing env vars though.

Answer 2

It is simply not possible. You have to use other mechanisms, e.g. don't store the password at all, but use system properties and configure them, when you execute the application.