title: Security with JSP/JavaBeans/Servlets/MySQL
body: <p><strong>Background</strong></p>
  
  <p>A html page will ask the user to type their username and password. These are credentials for a MySQL database (i.e. they will be used in JDBC connection so that no password is physically stored in the files).</p>
  
  <p>On submit a servlet will be called which tries to connect to the database. If it can, the credentials are correct and a JSP page will load. If not, an error will be displayed.</p>
  
  <p>If the login was a success, the web application will then use servlets perforimng SQL queries/updates on the database and returning Java Beans to JSP pages.</p>
  
  <p><strong>Questions</strong></p>
  
  <p>For memory purposes I'm guessing the JDBC will need to be closed meaning subsequent pages will need to restart the connection using the credentials provided earlier. Obviously the user doesn't want to be providing a password everytime so it's going to have to be stored anyway. If they are stored in a Java object/bean for that session (considering it would have to be plaintext so it could be retrieved and used)...are they susceptible to attack? Is that just a bad as storing it as text within the code?</p>
  
  <p>I'm assuming someone could hack into the session and call the object (if they know this?) with the details in and voila?</p>
  
  <p>What alternatives are there? </p>