How to secure my NodeJS code - no plain password and no text file if possible
<p>I have the following NodeJS code where, I'm successfully using mssql module to execute a stored procedure. I'm using var config = { .., password: '....', ... } section where I'm defining the user and password.</p>

<p>How can I make the following code secure i.e. I don't hard code OR have any password in this file OR in any external file. Idea is to use an encrypted password to make the connection and then it'll execute the stored procedure.</p>

<p>I saw there's a module in NodeJS called crypto but I'm trying to see how I can plug that into my code to get rid of the real password (at least).</p>

<p><a href="http://lollyrock.com/articles/nodejs-encryption/" rel="nofollow noreferrer">http://lollyrock.com/articles/nodejs-encryption/</a></p>

<p>If I use Environment variables and use those directly to populate the password variable, I saw some posts which says that even Environment variables can be exposed. <a href="https://stackoverflow.com/questions/32209972/hardcoded-mysql-user-and-password-in-node-js">Hardcoded mysql user and password in Node.js</a></p>

<p>Appreciate any help.</p>

<pre><code>//This computerName is what we'll find in our mssql server to see
//if the server entry exist or not and the stored procedure will take this as a parameter.
var computerName = "some.fake.server.com";
var secProfile = "";

var sql = require('mssql');

var config = {
    user: 'dbuser',
    //I want to get rid of the following password line from this section.
    password: 'secure9ass',
    server: 'dbserver.domain.com',
    database: 'DBName',
    pool: {
        max: 10,
        min: 0,
        idleTimeoutMillis: 30000
    }
}

sql.connect(config).then(function(output) {
  // Stored Procedure
    new sql.Request()
    .input("ComputerName", sql.VarChar(100), computerName)
    .execute('dbo.getSysStatus_ByName').then(function(recordsets) {
    console.dir(recordsets);
  }).catch(function(err) {
        // ... error checks
    console.log('ERROR1::: ' + err)
    console.log("----")
    console.log(err)
    console.log("====")
    console.log(recordsets)
    console.log("----")
    console.log('ERROR2::: '+ sqlOutput);
    console.log('ERROR3::: '+ request.parameters.sqlOutput.value);
});
  console.log(output);
}).catch(function(err) {
  // ... error checks
  console.log('ERROR5::: '+ err);
});
</code></pre>