如何加密Spring Boot应用中Liquibase的数据库密码？

Great question! Yes, you absolutely can encrypt the spring.liquibase.password property in your Spring Boot application's application.properties file—and it’s a critical security practice to avoid exposing plaintext credentials. Let’s break down the most practical, widely-used approaches:

1. Spring Boot + Jasypt (Most Common Approach) #

Jasypt integrates seamlessly with Spring Boot to encrypt sensitive properties, including Liquibase credentials. Here’s how to set it up:

• Add the Jasypt Spring Boot Starter dependency:
  For Maven, add this to your pom.xml:

  <dependency>
      <groupId>com.github.ulisesbocchio</groupId>
      <artifactId>jasypt-spring-boot-starter</artifactId>
      <version>3.0.5</version> <!-- Use the latest stable version -->
  </dependency>
  

  For Gradle, add to build.gradle:

  implementation 'com.github.ulisesbocchio:jasypt-spring-boot-starter:3.0.5'
  

• Generate the encrypted password:
  Use Jasypt’s command-line tool or a simple Java snippet to encrypt your plaintext Liquibase password. For example, via command line:

  java -cp jasypt-1.9.3.jar org.jasypt.intf.cli.JasyptPBEStringEncryptionCLI input="your_plaintext_password" password="your_encryption_key" algorithm=PBEWithHMACSHA512AndAES_256
  

  Replace your_plaintext_password with your actual password and your_encryption_key with a strong, secret key (never hardcode this key!).
• Update application.properties:
  Replace the plaintext password with the encrypted value wrapped in ENC():

  spring.liquibase.password=ENC(your_encrypted_password_here)
  

• Provide the encryption key at runtime:
  Avoid hardcoding the key in config files. Instead, pass it via environment variable, system property, or a secure vault. For example:
  • As a system property when starting the app:

    java -jar your-app.jar --jasypt.encryptor.password=your_encryption_key
    

  • As an environment variable:

    export JASYPT_ENCRYPTOR_PASSWORD=your_encryption_key
    java -jar your-app.jar
    

2. Liquibase Native Encryption #

Liquibase itself supports password encryption via custom password encoders. Here’s a quick overview:

• Implement a PasswordEncoder:
  Create a class that implements liquibase.util.PasswordEncoder, which handles encryption/decryption. For example:

  public class CustomLiquibasePasswordEncoder implements PasswordEncoder {
      @Override
      public String encode(String plaintext) {
          // Your encryption logic here (use strong algorithms!)
      }
  
      @Override
      public String decode(String encrypted) {
          // Your decryption logic here
      }
  }
  

• Configure Liquibase to use the encoder:
  Add this property to application.properties to tell Liquibase which encoder to use:

  spring.liquibase.password.encoder.class=com.yourpackage.CustomLiquibasePasswordEncoder
  

• Set the encrypted password:
  Replace the plaintext password in application.properties with your encrypted value, and Liquibase will automatically use your encoder to decrypt it.

3. Spring Cloud Config Encryption (For Distributed Systems) #

If you’re using Spring Cloud Config to manage your application’s configuration across multiple environments, you can leverage its built-in encryption capabilities:

• Enable encryption on the Config Server:
  Configure the Config Server to use a symmetric or asymmetric key (you’ll need the Java Cryptography Extension (JCE) installed for strong encryption).
• Encrypt the password via the Config Server API:
  Send a POST request to the Config Server’s /encrypt endpoint with your plaintext password to get the encrypted value.
• Store the encrypted password in your config repository:
  In your Config Server’s git repository (or other backend), add the encrypted password wrapped in {cipher}, like:

  spring.liquibase.password={cipher}your_encrypted_password_here
  

• Spring Boot clients will automatically decrypt the value when pulling configuration from the Config Server.

Key Security Notes #

• Never hardcode encryption keys: Use environment variables, secure vaults (like HashiCorp Vault, AWS KMS), or other secret management tools to store your keys.
• Use strong encryption algorithms: For Jasypt, prefer algorithms like PBEWithHMACSHA512AndAES_256 over weaker defaults.
• Test thoroughly: Verify that Liquibase can successfully connect to your database after encryption to avoid runtime issues.

内容的提问来源于stack exchange，提问作者hell_storm2004