Hide passwords in application properties of Spring boot application

Question

Whenever the question of hiding the fields like passwords in application properties file arises,the straight-forward answer is encrypt those details using jasypt or other encryption. If you keep encrypted passwords and jasypt details in same file, how does that make sense? or may be keep them in different file..

Any other smarter way for this?

Answer 1

You're not supposed to save the encryption key in application.properties, after all you don't want it going to your repository. You have to provide the key to your application when you run it, either by typing it or by storing it somewhere on your server. Check this thread for examples.

Answer 2

Let's assume that you have gotten your passwords in a typical application.properties file. Using Jaspyt, you may encrypt as follows:

• Maven setup.... Grab the latest spring boot starter Jasypt POM, use com.github.ulisesbocchio as the group ID.

• Create a tiny utility class (preferably outside your spring boot app) to encrypt your passwords; it's easy to use Jasypt's BasicTextEncryptor class ex:

  BasicTextEncryptor pwdEncrypt = new BasicTextEncryptor(); 
  pwdEncrypt.setPassword(your_secret_sauce)//whatever you use here will be needed in the properties file (more on that later)
  String encoded = pwdEncrypt.encrypt(password_you_want_to_encrpyt);
  

• The String encoded is PBE-encoded by default; grab that

• In your properties file, make the following entries:

  jasypt.encryptor.password=your_secret_sauce //used in your utility
  password_entry_you_want_to_encrypt=ENC(encoded) //encoded grabbed from your utility class
  

• I'll assume that you're annotating your main class with @SpringBootApplication. Add the following annotations as well:

  @EnableEncryptableProperties
  @PropertySource(name="EncryptedProperties", value = "classpath:application.properties")
  

Answer 3

Use jasypt to encrypt properties in application.properties file.
it's usesPBEWithMD5AndDES for the encryption.
See: https://github.com/ulisesbocchio/jasypt-spring-boot