Stop App snooping through Session scope

Right, haven't had to think about this too much before as I've always been working on projects on our own servers, but I'm now working on a project which will be hosted on a shared server. Irritatingly this brings me back to investigating Application scope snooping, and trying to find a way around it.

And no don't even bother saying about a Multiserver install, I know that's for an ideal world but it's not the case here.

Generally, I'd store my database connection details in the App scope, but obviously they can be read by other users on the box. I could wrap it up in a class, but even that can be executed by another app.

I did, however, have a thought - what they *cannot* do is read my actual Application.cfc file. So how about I do something like this:

<onAppStart>

  <cfset variables.secretkey =  '94yhf934h9p3v' />

  <cfset application.database.secretpassword = encrypt('mypassword', variables.secretkey , 'DESEDE') />

</onAppStart>

That way, the password is in the app scope (ie one place) but encrypted if anyone tries to look at it. I then do:

<onSessionStart>

  <cfset session.database.secretpassword = decrypt(application.database.secretpassword , variables.secretkey, 'DESEDE') />

</onSessionStart>

Then in my code just reference session.database.secretpassword rather than the application-level version. That way nothing is visible in the Application scope, as it's all in the Session scope which other users cannot traverse. I know memory-wise it's not as efficient, but if it's the difference between giving away my database credentials and not, then I'm not overly fussed.

Any issues anyone can see with that? Anything obvious I've missed? Any ways of improving it?

Damn, I am ALL OVER these forums today.

Cheers people

O.