Externalize password in Spring Boot properties file

Question

i have application.properties file

which has

spring.profiles.active=local

and i have application-local.properties which has many fields including

api.password = password123

As you can see i have hard coded password123 in properties file.

Suppose i am on windows and i have app.properties file on windows which has

 api.password = password123

And i want to read api.password in spring boot properties file through app.properties

How can i achieve it ?

Where is the difference ? You don't gain more security just by adding a second file — Marged, Sep 27 '19 at 03:40
do you want to read only that property? or all properties from `app.properties` file? — Ryuzaki L, Sep 27 '19 at 03:56
Maybe you can put the password in your environment variables — fctmolina, Sep 27 '19 at 04:14
@Marged i do I wont be app.properties to my GIT HUB It would be on Linux machine for each environment i.e DEV,UAT AND PROD — Oracle Monkey, Sep 27 '19 at 04:20
I would suggest keep property in you application.yml only however when you start your application you can password from command line like java -jar -Dapi.password=mysecretpassword myApp.jar (you can also create bat/.sh file for it) but using it only on command line will ensure password is nowhere lying on machine — Shailesh Chandra, Sep 27 '19 at 04:56
Possible duplicate of [springboot external configuration - profile specific configuration](https://stackoverflow.com/questions/51186918/springboot-external-configuration-profile-specific-configuration) — Marged, Sep 27 '19 at 05:38

score 3 · Answer 1 · answered Sep 27 '19 at 05:18

Startup parameters

If you want to read properties from a non-standard location, you can start your application with --spring.config.location or with --spring.config.additional-location parameters.

$ java -jar app.jar --spring.config.location=file:./app.properties

https://docs.spring.io/spring-boot/docs/current/reference/html/boot-features-external-config.html#boot-features-external-config-application-property-files

@PropertySource

If you don't control startup parameters, you can use @PropertySource annotation. Simply annotate your main class (or any other configuration):

 @PropertySource("file:.app.properties")

You can set ignoreResourceNotFound=true, so the application will start, even if the file is not there.

https://docs.spring.io/spring/docs/5.1.9.RELEASE/javadoc-api/org/springframework/context/annotation/PropertySource.html

Read the documentation

There are literally 17 ways to pass properties to a Spring-Boot application.

I suggest, you get familiar with the convention, as it is crucial to understand which file takes a precedence:

https://docs.spring.io/spring-boot/docs/current/reference/html/boot-features-external-config.html#boot-features-external-config

score 1 · Answer 2 · edited Sep 27 '19 at 05:04

1

Probably you can use --spring.config.location like below

$ java -jar myApp.jar --spring.config.location=file:/directoryof file/app.properties

edited Sep 27 '19 at 05:04

Marged

10,577
10
57
99

answered Sep 27 '19 at 03:55

Niraj Jha

455
3
10

If you are sure only then answer.Your technique won;'t work – Oracle Monkey Sep 27 '19 at 04:22
This way are you able to load properties file? – Niraj Jha Sep 27 '19 at 04:25
If you want to read out of your classpath this is the only way. As you are using profile so you have to use $ java -jar myApp.jar --spring.config.name=app --spring.config.location=file:/propertfilefoldername – Niraj Jha Sep 27 '19 at 04:36
@OracleMonkey it works, you should honor that people try to help you – Marged Sep 27 '19 at 05:06

score 0 · Answer 3 · answered Sep 27 '19 at 10:54

i used jasypt : https://github.com/ulisesbocchio/jasypt-spring-boot to encrypt the password, then you supply a decryption string (jasypt.encryptor.password) as startup parameter. That way no useabel password is in the configuration and on the git-repos.....

Externalize password in Spring Boot properties file

3 Answers3

Startup parameters

@PropertySource

Read the documentation