Example - 1

Below is a snippet from a Java properties file.

webapp.ldap.username = secretUsernamewebapp.ldap.password = secretPassword

Because the LDAP credentials are stored in plaintext, anyone with access to the file can gain access to the resource.

Example - 2

The following examples show a portion of properties and configuration files for Java and ASP.NET applications. The files include username and password information but they are stored in cleartext.

This Java example shows a properties file with a cleartext username / password pair.

// # Java Web App ResourceBundle properties file// 
...webapp.ldap.username=secretUsernamewebapp.ldap.password=secretPassword...

The following example shows a portion of a configuration file for an ASP.Net application. This configuration file includes username and password information for a connection to a database but the pair is stored in cleartext.

<add name="ud_DEV" connectionString="connectDB=uDB; uid=db2admin; pwd=password; dbalias=uDB;" providerName="System.Data.Odbc" />
...<connectionStrings></connectionStrings>...

Username and password information should not be included in a configuration file or a properties file in cleartext as this will allow anyone who can read the file access to the resource. If possible, encrypt this information.