Question

I have a stand-alone open source Java application. I distribute the software through a website. Currently, users are asked to submit their name and email address on the website before thy download the software. I use this email list to send people information about updates and such. My problem is that the website registration gets a lot of spam despite security measures.

As an alternative, I would like to have a registration page in the software and have the software send the registration information to the database on my server. This part is easy to implement, but my concern is that the connection string will be hard coded in an open source application. My database would be exposed to anyone who obtained the source code. Does anyone have an idea of how I can have my stand-alone application send user information to a database without this security problem?

Thanks

Answer 1

You should never publicly expose your database ports, let alone its login credentials, so you’re right that this isn’t what you want to do. It’s the most insecure thing you can do.

That being said, you can write a Java application that sits on your server and accepts connections, sort of like a broker for your database, that accepts HTTP requests, then have the client send HTTP requests to the server when the user enters his information. This would ensure that your database isn’t public and you aren’t exposing user’s data or your login information.

An easy way to do this might be using something like Apache’s HttpComponents library.