SpringBoot实现配置文件加密的方案分享

spring:
  datasource:
    driver-class-name: com.mysql.jdbc.Driver
    url: jdbc:mysql://127.0.0.1:3306/test?useSSL=false
    username: root
    password: root
  redis:
    host: 127.0.0.1
    port: 6379
    password: 123456

<dependency>
    <groupId>com.github.ulisesbocchio</groupId>
    <artifactId>jasypt-spring-boot-starter</artifactId>
    <version>3.0.3</version>
</dependency>

import org.jasypt.encryption.pbe.StandardPBEStringEncryptor;
import org.jasypt.encryption.pbe.config.EnvironmentStringPBEConfig;

/**
 * 使用Jasypt对配置文件进行加密
 */
public class JasyptUtil {

    /**
     * 加密算法 加密解密保证同一种算法
     * jasypt3.0后，默认支持的算法为 PBEWITHHMACSHA512ANDAES_256，这种算法安全性更高，但是需要 Java JDK 1.9+或添加JCE(Java Cryptography Extension 无限强度权限策略文件)
     * 使用PBEWithMD5AndDES算法即可
     */
    private static final String algorithm ="PBEWithMD5AndDES";
    //密钥，对称加密使用同一个密钥进行加解密，密钥自己定义，注意保管
    private static final String key ="test";

    public static void main(String[] args) {
        //加密方法示例
        String encryptInfo = encrypt("root");
        System.out.println(encryptInfo);
        //解密方法示例
        String decryptInfo = decrypt(encryptInfo);
        System.out.println(decryptInfo);
    }

    /**
     * 加密
     *
     * @param value 明文
     * @return
     */
    public static String encrypt(String value) {
        StandardPBEStringEncryptor encryptor = new StandardPBEStringEncryptor();
        EnvironmentStringPBEConfig config = new EnvironmentStringPBEConfig();
        // 指定算法
        config.setAlgorithm(algorithm);
        // 指定秘钥
        config.setPassword(key);
        encryptor.setConfig(config);
        // 加密数据
        return encryptor.encrypt(value);
    }

    /**
     * 解密
     *
     * @param value 密文
     * @return
     */
    public static String decrypt(String value) {
        StandardPBEStringEncryptor encryptor = new StandardPBEStringEncryptor();
        EnvironmentStringPBEConfig config = new EnvironmentStringPBEConfig();
        config.setAlgorithm(algorithm);
        config.setPassword(key);
        encryptor.setConfig(config);
        // 解密数据
        return encryptor.decrypt(value);
    }
}

java -cp ./jasypt-1.9.3.jar org.jasypt.intf.cli.JasyptPBEStringEncryptionCLI password="test" algorithm=PBEWithMD5AndDES input=root

<plugin>
    <groupId>com.github.ulisesbocchio</groupId>
    <artifactId>jasypt-maven-plugin</artifactId>
    <version>3.0.3</version>
    <configuration>
        <path>file:src/main/resources/application.yml</path>
    </configuration>
</plugin>

server:
  port: 8030
spring:
  datasource:
    url: jdbc:mysql://localhost:3306/test?useSSL=false
    driver-class-name: com.mysql.jdbc.Driver
    username: DEC(root)
    password: DEC(root)
jasypt:
   encryptor:
     password: test

mvn jasypt:encrypt -Djasypt.encryptor.password=test

mvn jasypt:decrypt -Djasypt.encryptor.password=test

spring:
  datasource:
    url: jdbc:mysql://localhost:3306/test?useSSL=false
    driver-class-name: com.mysql.jdbc.Driver
    username: ENC(加密之后的属性)
    password: ENC（加密之后的属性)
jasypt:
   encryptor:
     password: 自定义的密钥

java -jar demo.jar --Djasypt.encryptor.password=test