SpringBoot如何对密码等敏感信息进行脱敏处理

<dependency>
    <groupId>com.github.ulisesbocchio</groupId>
    <artifactId>jasypt-spring-boot-starter</artifactId>
    <version>3.0.5</version>
</dependency>

BasicTextEncryptor encryptor = new BasicTextEncryptor();
encryptor.setPassword("your-secret-key"); // 加密密钥
String encryptedPassword = encryptor.encrypt("your-real-password");

spring:
  datasource:
    password: ENC(encryptedPassword)

java -jar your-app.jar --jasypt.encryptor.password=your-secret-key

public class MaskedPropertySource extends PropertySource<Map<String, Object>> {
    public MaskedPropertySource(String name, Map<String, Object> source) {
        super(name, source);
    }
 
    @Override
    public Object getProperty(String name) {
        Object value = source.get(name);
        if (name.contains("password") && value != null) {
            return "​**​*​**​*"; // 返回脱敏值
        }
        return value;
    }
}

<configuration>
    <conversionRule conversionWord="maskedMsg" converterClass="com.example.MaskingPatternLayout"/>
    <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
        <encoder>
            <pattern>%d{HH:mm:ss} [%thread] %-5level %logger{36} - %maskedMsg%n</pattern>
        </encoder>
    </appender>
    <root level="info">
        <appender-ref ref="CONSOLE" />
    </root>
</configuration>

public class MaskingPatternLayout extends PatternLayout {
    @Override
    public String doLayout(ILoggingEvent event) {
        String message = super.doLayout(event);
        return message.replaceAll("password\":\"(.*?)\"", "password\":\"​**​*​**​*\"");
    }
}

public class UserDTO {
    private String username;
 
    @JsonIgnore // 完全忽略该字段
    private String password;
 
    @JsonProperty(access = Access.WRITE_ONLY) // 仅允许写入，响应时不序列化
    private String secretKey;
}

public class PasswordSerializer extends JsonSerializer<String> {
    @Override
    public void serialize(String value, JsonGenerator gen, SerializerProvider provider) 
        throws IOException {
        gen.writeString("​**​*​**​*"); // 返回固定脱敏值
    }
}
 
// 在DTO字段上指定序列化器
public class UserResponse {
    @JsonSerialize(using = PasswordSerializer.class)
    private String password;
}

export SPRING_DATASOURCE_PASSWORD=your_password