Prevent auth data in eclipse project from being saved to a repository

Question

I'm working on an Android project with Eclipse and I use a git repository with EGit. I have data (in my case two strings, OAuth key and secret) that I need in my project, but I don't want it to be pushed to the git repository.

My first thought was to define the strings as compiler parameter, as the project settings are not included in the git repository. I'm used to doing this in C/C++ and it is no problem in Eclipse, but in the Java/Android project this option seems to be missing.

So, how do you set up sensitive data that is used in a java project and is not pushed to a code repository along with the rest of the code?

Maybe make them static strings inside a class that is ignored, then add that source file to the git ignore list? — ug_, Sep 08 '13 at 07:49
@ns47731 This is a very good idea. Could you post this as an answer so I can accept it? — Gerald Schneider, Sep 08 '13 at 09:47

score 2 · Accepted Answer · answered Sep 08 '13 at 19:42

2

Make them static variables inside a class file that is ignored by Git. This would cause compiler errors for people downloading the source but it should be pretty self explanatory for the user to fix it themself as long as you keep the variables inside that class file to a minimum. Like AuthData.FB_SECRET

answered Sep 08 '13 at 19:42

ug_

11,267
2
35
52

What I did: I created a class with empty static variables (`public static String Key = "";`) and committed it to git. Then I added the file to .gitignore, so future changes won't be committed, and entered my data. So far this works exactly as intended. – Gerald Schneider Sep 08 '13 at 20:10
Nice fix, I dont use Git much so I'm not familiar with their inner workings. But if you added it to the ignore list when you commit next time will Git think that you have removed the file and call for it to be deleted from the SVN? – ug_ Sep 08 '13 at 20:14
No, it will just keep the file at the currently committed state. To delete it from the repository I have to explicitly do so. – Gerald Schneider Sep 08 '13 at 20:32

score 1 · Answer 2 · edited May 23 '17 at 12:11

1

You could also store those two string in an encrypted (and ignored by git) file.
See for instance "Encrypt Password in Configuration Files? (Java)".

Even if that file was somehow pushed... it would still be encrypted.

edited May 23 '17 at 12:11

Community

1
1

answered Sep 08 '13 at 07:58

VonC

1,262,500
529
4,410
5,250

This is a possibility, but it adds way more overhead to the app than I like. – Gerald Schneider Sep 08 '13 at 20:11

Prevent auth data in eclipse project from being saved to a repository

2 Answers2