CODEWITHSUNDEEP
springspring-boot
Charles Morin
Charles Morin

Reputation: 1447

Spring Boot best practices for hiding or encrypting passwords

I have been using the Spring Framework for about 4 years now, and now Spring Boot for the last couple of months. My Spring MVC applications are usually deployed on a Java EE container such as JBoss/WildFly or WebLogic. Doing so allows me to use JNDI for things like datasources or any other sensitive data that involve secrets/passwords. That makes my app "consume" that JNDI resource based on its name.

Now with Spring Boot and especially for self-contained microservices (embedded tomcat), that information is now stored within the application (application.properties and/or in Spring Java Config classes), so versioned in Git.

That makes that information a lot more exposed to other developers, which I'm not very comfortable with. I also don't like having those details show up in SonarQube and Jenkins (through workspaces).

Question is: Are there any best practices for this specific requirement?

* UPDATE * I see some articles here and there about the use of Jasypt, but I wonder if it's still a valid library to use since the last stable release is dated from 2014.

Thank you

Upvotes: 6

Views: 1792

Answers (2)

Thiru
Thiru

Reputation: 2699

If you have spring cloud in your stack, then it's very easy. Use encrypt the value and put it in the application properties. Follow the instruction mentioned here.

Other way is, set the values as environmental variables and using the environmental variables in the application properties. Instructions here

Upvotes: 1

Farzad
Farzad

Reputation: 1142

You could consider using a vault. Spring supports a few of them out of the box. You can find more information here http://projects.spring.io/spring-vault/.

Upvotes: 1

Related Questions