Is it secure to store my mysql password in a const std::string?

Question

I am implementing a C++ server with a mariadb backend. I have to access my database and I do so using the mariadbpp (its c++ connector). Though I can use mysql_config_editor and store the passwords in an (encrypted) .cnf file, mariadbpp's API needs a password. This is how I am using it:

mariadb::account_ref acc = mariadb::account::create("localhost", "order", "<password>", "Orders");

The database is configured to only be accessible from localhost. Is putting the password in .cpp source file okay from security perspective?

Note that storing the password in a const std::string at runtime is independent of hardcoding it in the program's source code. It's only the latter that's a bad idea. — Joseph Sible-Reinstate Monica, Feb 23 '19 at 15:01
I am not sure I understand what you said @JosephSible . Do you mean storing the password in const std::string from a file, (at run time) is the same as hardcoding it. Just the latter is a really bad idea coz the hacker can analyze the binary and figure that out? — Hemil, Feb 24 '19 at 05:54

score 3 · Accepted Answer · answered Feb 23 '19 at 10:36

3

Hardcoding of secrets is never a good idea.

Use a configuration file, to read from. This way you will be able to swiftly change the password if required and prevent the password from leaking through version control or binary analysis.

answered Feb 23 '19 at 10:36

Euphrasius von der Hummelwiese

1,018
4
20

Do you have any idea how to do that in Mariadbpp? – Hemil Feb 23 '19 at 10:44
I'm not familiar with mariadbpp, and cannot tell whether it offers built-in functionality for this, but your C++ binary could easily parse a configuration file, store the password from there in a variable and later use the variable to connect to the database. – Euphrasius von der Hummelwiese Feb 23 '19 at 10:58
Ya. Thats a good idea. How could I forget that – Hemil Feb 23 '19 at 11:00

Is it secure to store my mysql password in a const std::string?

1 Answers1