SpringBoot configuration file database password encryption

foreword

In our daily development, we may easily expose the database password directly in the configuration file in plain text. This can be done in the development environment, but it is not recommended to do so in the production environment. After all, security is no small matter, and no one knows where The day password was inexplicably leaked. Let’s talk about how to encrypt database passwords in the springboot project today

practice

Introduce maven dependency

        <dependency>
            <groupId>com.github.ulisesbocchio</groupId>
            <artifactId>jasypt-spring-boot-starter</artifactId>
            <version>2.1.0</version>
        </dependency>

Configure the secret key in the Springboot configuration file

jasypt:
  encryptor:
    password: EbfYkitulv73I2p0mXI50JMXoaxZTKJ7 

It is not safe to write the secret key in the configuration file during testing.
In the IDE tool, we can put the secret key in the startup parameters.

jasypt.encryptor.password=EbfYkitulv73I2p0mXI50JMXoaxZTKJ7

Just add parameters when starting the project in the production environment

java -jar  -Djasypt.encryptor.password=EbfYkitulv73I2p0mXI50JMXoaxZTKJ7 xxx.jar

generate ciphertext

Build a test class to generate the encrypted ciphertext of the password

@RunWith(SpringRunner.class)
@SpringBootTest
public class TestDemo {
    
    
    @Autowired
    StringEncryptor stringEncryptor;//密码解码器自动注入

    @Test
    public void test() {
    
    
        String name = encryptor.encrypt("root");
        String password = encryptor.encrypt("123!@#");
        System.out.println(name);//n3UKAujtutC8u9qJaSm1uA==
        System.out.println(password );//bfc7g2lOcAP79kVGo9MmGA==
    }
}

It is also possible to generate input locally through the Java command as the content to be encrypted and password as the secret key

java -cp  E:\repository\org\jasypt\jasypt\2.1.0\jasypt-2.1.0.jar
org.jasypt.intf.cli.JasyptPBEStringEncryptionCLI
input="root" 
password=EbfYkitulv73I2p0mXI50JMXoaxZTKJ7

Use in the configuration file
to change the plaintext password in the configuration file to an encrypted password, and wrap an ENC() outside

spring:
  datasource:
    driver-class-name: com.mysql.jdbc.Driver
    url: jdbc:mysql://127.0.0.1:3306/user?serverTimezone=UTC
    username: ENC(n3UKAujtutC8u9qJaSm1uA==)
    password: ENC(bfc7g2lOcAP79kVGo9MmGA==)