将私钥存储在 ServletContext 中
我想听听您的意见。我正在开发一个 Servlet，它必须签署发送到端点的请求。
为了避免从服务器的密钥库文件中读取、加载它并获取私钥，我在实现 ServletContextListener 的侦听器中完成所有这些操作。这样，仅当 servlet 初始化（部署）时才会执行此操作。
获得私钥后，我将其存储在应用程序的 ServletContext 中。您认为这是一个好的设计决策吗？
提前致谢。
I would like your opinion. I am developing a Servlet that has to sign the requests that it sends to an endpoint.
In order to avoid read from file the server's keystore, load it and get the private key, I am doing all of that in a listener that implements ServletContextListener. In this way this is done only when the servlet is initialised (deployed).
Once I get the private key I am storing it in the application's ServletContext. Do you think that is a good design decision?
Thanks in advance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
无论您选择哪种解决方案，您有时都会在内存中拥有私钥。因此任何能够访问内存的破解者都可以找到一种方法来获取这个私钥。对我来说，加载一次并在启动时将其存储在内存中似乎是一个很好的解决方案。只需确保服务器不易被恶意人员访问即可。
Whatever solution you choose, you'll have the private key in memory at some time. So any cracker having access to the memory could find a way to get this private key. Loading it once and storing it in memory at startup looks like a good solution to me. Just make sure that the server is not easily accessible to malicious persons.