Storing credentials in a Google App Engine Java server - java

I have a Java Server running on Google App Engine, with integrations with third-party services (eg. SendGrid).
What's the best way to store credentials (usernames/passwords, API keys) for these third-party services? In the Java code, or through a configuration file such as web.xml or appengine-web.xml, or elsewhere? How would I access the credentials through code?

If you are using Java in GAE then,
You can save the credentials in file under src/main/resources/ or if you are not using this structure, put the file in src package.
ClassLoader classloader = Thread.currentThread().getContextClassLoader();
InputStream is = classloader.getResourceAsStream("credentials.json");
or
InputStream is = AnyClassName.class.getResourceAsStream("credentials.json");
How to read is answered in this, How do I load a file from resource folder?
then you can convert the inputStream to Map or any pojo using any Json libraries, popular ones are,
Gson
Jackson
Also make sure the file is not tracked in version control (if you use any), so that the file not available for others, and only during deployment you can inject that file.
Same kind of solution applies for other languages also, just not the same folder structure like java.

In my opinion it is good to save sensitive data in external files in WEB-INF folder. A lot of keys from third-party services can be downloaded like file and you need just paste it, like
And you can access it in code like
getServletContext().getResourceAsStream("/WEB-INF/credentials.json")

Related

Play 2.4.x -- how to create a zip file download of several private assets

Please note this is NOT a duplicate of this question: Hot to create a zip file with Play! Framework?
What I'm asking is to assemble a series of (private) assets -- some of which may be static files but more importantly some of which will be XML files generated with #twirl.
I do see the Java libraries and I've done things like that before and I could see perhaps having the Java libraries call those assets by URL (somehow passing or bypassing security) and then subsequently assembling all those files into a master ZIP file but I have to believe that there would/should be a far, far more elegant way to do this using something like the Promises/Futures structure? (Much like the main page of LinkedIN is done with live assembling of the various components from numerous resources).
Anyone have any ideas?

Generating Site maps in java and making them available publicly

I'm using a java framework, Tapestry5. I have millions of pages and I'd like to generate my sitemaps with a nightly cron job rather than dynamically generate them on the fly. The problem I'm facing is I don't seem to know how to place the xml sitemaps dynamically in a directory that can be read publicly. Currently I have a manually written xml sitemap that points to dynamically written ones. The manually written sitemap is placed in the Web Pages / webapp directory along side the robots.txt file. How do I place a file there with java?
It's generally a bad idea to write to areas within your WAR directory. Fortunately, all the popular web and app servers (except perhaps some cloud hosting environments like Google App Engine) have the ability to configure an arbitrary directory on the file system as the path corresponding to particular URL patterns. This gives you the freedom to put the sitemap files anywhere you want.

How to add external resources to dynamic web project eclipse?

I'm creating a dynamic web project in eclipse using jsps and java servlets, however I want to add some external files to be edited using the app. Where do I put them such that I can open them from my app and save an edited version - and finally provide a link for a download of the edited file?
Thanks
Where do I put them
Nobody cares. Really. As long as it's not in the deploy folder, of course.
If your concrete problem is avoiding to hardcode the exact external location in Java source code, just provide it as VM argument, environment variable, properties file setting, or whatever externally configurable. For detail, see also Recommended way to save uploaded files in a servlet application.
And/or if your concrete problem is serving those files back to the web, just either tell the server to publish the external location into the web as well, or create a servlet which reads from the external location and writes to the response. For detail, see also Load images from outside of webapps / webcontext / deploy folder using <h:graphicImage> or <img> tag.

Does Java Web Start give a default program folder?

For Java Web Start is there a default place to store and access data related to my program? Or do I need to create a folder? For Java Web Start (assuming I don't get a program folder) is it standard to just create on in Program Files for window, Applications for mac, etc?
I would use a subdirectory in the users home directory. E.g. System.getProperty("user.home") + File.separator + ".myapp/"
But for that the user has to add extra permissions for the a web start application.
To persist you can use a properties file or XmlEncoder which are included in the JDK. Or use external libraries like XStream, Xvantage or the simple framework where it is simple as
xstream.save(anyObject)
In addition to the Preferences API for storing user settings there are a few services that can be found in the javax.jnlp package.
For your concrete requirement the PersistenceService would be particularly useful.
Alternatively you can simply provide all data that your application requires as part of your .jar files, reference them in your .jnlp file and customize how and when they are downloaded by using the DownloadService.
There is no specific default place to store and access data related to your program with webstart. However Java does have the Preferences API to provide a platform independant way of storing configuration without worrying about the specific storage location/format.

War-file deployment with shared resources

Consider the following example structure
- Project
- www
- files
+ documents
+ html
+ images
+ scripts
- WEB-INF
* web.xml
The documents folder needs to be a symlink or in some other way external from the war file because users will add and remove documents (through a mapped network drive).
I'd like to deploy the webapp as a war-file but I don't know how to do that and take the above into account. Could you give some pointers?
/Adam
If it's static content, maybe you'd be better off fronting your app server with a web server and putting the static content there. You relieve the app server of having to serve up static data and save a network roundtrip to boot.
I agree with #duffymo.myopenid.com that fronting your app server with a web server that serves static content for certain URL prefixes is a good, clean solution.
If this isn't feasible in your environment or if you decide that you'd rather handle it in the web application itself, you could write a servlet that effectively does the same thing. For example, create a servlet that is mapped to the URL pattern /documents/*. This servlet could parse the URL (/documents/some/file.png) to determine a relative filename (some/file.png). It could then read and return the corresponding contents found in an external directory (/staticDocs/some/file.png).
Why not store the documents etc. in a database, then have the web-app access the database and allow users to pull files that way? Does it have to be a mapped network drive?
Otherwise if it's a matter of knowing what is there, you could always construct the jnlp file dynamically and pass file lists, etc. in as arguments (if they are server side).
Guess we need to know a little more about what you are trying to accomplish.
Basically, it's a webapp that aggregates information from various sources and generates documents. It's a requirement that users have the ability to create and upload documents manually from the network without being logged in to the webapp.
Putting the document location path as a context variable is definately doable. I guess it's the easiest way. /Adam
Unfortunately, for you .war files are .zip files at heart and .zip files do not support symbolic links. If you are ONLY deploying to a windows machine you may have luck using a shortcut file. However, I'm not sure if the app-server will like that (... probably not.)
I would recommend adding a configuration parameter to the application that allows the document folder's full path to be specified there. The default path should be relative ("./www/files/documents") so that the app works out of the box without additional configuration.
Many java web servers support "exploded war files" where you just unzip your .war file into the deployment directory. With tomcat you copy this to $CATALINA_HOME/webapps and you're done.
This should work for you.
What about creating an environment variable on your server that points to the directory the files are stored in? The environment variable may work better than a setting inside your WAR file because you could deploy your application in a new environment (maybe moving from DEV to PROD) without changing your WAR file.
From your java code, you can reference this environment setting with:
String docPath= System.getProperty("DOC_PATH");
In Apache Tomcat it may sometimes be appropriate to achieve reuse via the tomcat RewriteValve like this:
META-INF/context.xml:
<Context>
<Valve className="org.apache.catalina.valves.rewrite.RewriteValve" />
</Context>
WEB-INF/rewrite.config:
RewriteRule (.*)/login(/.*\.)(png|jpg|js|css) $1$2$3
Now the /appContext/login/ path will use the same images/js/css as /appContext/
Of course as with all regular expression based solutions to ANY problem, keeping the complexity of the expression low is important for performance.
Sounds like you need a web Content Management System (CMS).

Categories

Resources