SpringBoot整合Jasypt实现配置文件和数据库字段敏感数据的加解密

<dependency>
        <groupId>com.github.ulisesbocchio</groupId>
        <artifactId>jasypt-spring-boot-starter</artifactId>
        <version>3.0.5</version>
</dependency>

jasypt:
    encryptor:
        password: 123456

import com.ulisesbocchio.jasyptspringboot.annotation.EnableEncryptableProperties;
import org.jasypt.encryption.StringEncryptor;
import org.jasypt.encryption.pbe.PooledPBEStringEncryptor;
import org.jasypt.encryption.pbe.config.SimpleStringPBEConfig;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
@EnableEncryptableProperties
public class StringEncryptorConfig {
    @Bean("jasyptStringEncryptor")
    public StringEncryptor stringEncryptor() {
        PooledPBEStringEncryptor encryptor = new PooledPBEStringEncryptor();
        SimpleStringPBEConfig config = new SimpleStringPBEConfig();
        config.setPassword("password");
        config.setAlgorithm("PBEWITHHMACSHA512ANDAES_256");
        config.setKeyObtentionIterations("1000");
        config.setPoolSize("1");
        config.setProviderName("SunJCE");
        config.setSaltGeneratorClassName("org.jasypt.salt.RandomSaltGenerator");
        config.setIvGeneratorClassName("org.jasypt.iv.RandomIvGenerator");
        config.setStringOutputType("base64");
        encryptor.setConfig(config);
        return encryptor;
    }
}

    @Bean("encryptorBean")
    public StringEncryptor stringEncryptor() {
    	//参考上面的配置参数
        ...
    }

	@Resource(name = "jasyptStringEncryptor")
    private StringEncryptor stringEncryptor;

    @Test
    public void testJasypt() {
        String mysqlRoot = stringEncryptor.encrypt("root");
        String mysqlPassword = stringEncryptor.encrypt("123456");
        System.out.println("mysqlroot加密后："+mysqlRoot);
        System.out.println("mysqlPassword加密后："+mysqlPassword);
        System.out.println("===================");
        System.out.println("mysqlRoot解密后："+ stringEncryptor.decrypt(mysqlRoot));
        System.out.println("mysqlPassword解密后："+ stringEncryptor.decrypt(mysqlPassword));
    }

# 数据源配置
spring:
    #数据源配置
    datasource:
        type: com.alibaba.druid.pool.DruidDataSource
        driverClassName: com.mysql.cj.jdbc.Driver
        druid:
            url: jdbc:mysql://localhost:3306/docker_test?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=true&serverTimezone=GMT%2B8
            # 未加密前
            #username: root
            #password: 123456
            # 加密后
            username: ENC(TBTl1fiJ7tilJ91sEdym6G8vEQG7Wn3QhIBU77mrfzCtqkHPMEMAihvpjokqUgMP)
            password: ENC(9galEBTwYzgGG6ER3oY+k45463tkvYSnt+epH8SE/hldbi13hg3+XL7CPKpgJAQp)

jasypt:
  encryptor:
    property:
      prefix: "MICRO["
      suffix: "]"

private static class MyEncryptablePropertyDetector implements EncryptablePropertyDetector {
    @Override
    public boolean isEncrypted(String value) {
        if (value != null) {
            return value.startsWith("MICRO");
        }
        return false;
    }
    @Override
    public String unwrapEncryptedValue(String value) {
        return value.substring("MICRO".length());
    }
}

@Bean(name = "encryptablePropertyDetector")
    public EncryptablePropertyDetector encryptablePropertyDetector() {
        return new MyEncryptablePropertyDetector();
    }

java -jar your-project.jar --jasypt.encryptor.password=password

import javax.persistence.AttributeConverter;
import javax.persistence.Converter;
import org.jasypt.util.text.AES256TextEncryptor;

@Component
@Converter
public class EncryptedStringConverter implements AttributeConverter<String, String> {

    @Resource(name = "jasyptStringEncryptor")
    private StringEncryptor stringEncryptor;

    @Override
    public String convertToDatabaseColumn(String attribute) {
        return stringEncryptor.encrypt(attribute);
    }

    @Override
    public String convertToEntityAttribute(String dbData) {
        return stringEncryptor.decrypt(dbData);
    }
}

import javax.persistence.Column;
import javax.persistence.Convert;
import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;

@Entity
public class User {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Convert(converter = EncryptedStringConverter.class)
    @Column(name = "password")
    private String password;

    // Getters and Setters
}