Spring Boot集成Jasypt：无法使用JVM参数时的程序化替代方案

1. 自定义Encryptor配置类 #

直接通过配置类指定加密密码，支持从任意自定义来源（环境变量、本地文件、数据库等）获取密码，替代Jasypt默认配置：

import org.jasypt.encryption.StringEncryptor;
import org.jasypt.encryption.pbe.PooledPBEStringEncryptor;
import org.jasypt.encryption.pbe.config.SimpleStringPBEConfig;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class JasyptConfig {

    @Bean("jasyptStringEncryptor")
    public StringEncryptor stringEncryptor() {
        PooledPBEStringEncryptor encryptor = new PooledPBEStringEncryptor();
        SimpleStringPBEConfig config = new SimpleStringPBEConfig();
        
        // 从自定义来源读取密码，示例为环境变量，可替换为读文件、接口调用等逻辑
        config.setPassword(getEncryptPassword()); 
        config.setAlgorithm("PBEWithMD5AndDES");
        config.setKeyObtentionIterations("1000");
        config.setPoolSize("1");
        config.setProviderName("SunJCE");
        config.setSaltGeneratorClassName("org.jasypt.salt.RandomSaltGenerator");
        config.setStringOutputType("base64");
        encryptor.setConfig(config);
        return encryptor;
    }

    private String getEncryptPassword() {
        return System.getenv("JASYPT_ENCRYPT_PWD");
    }
}

注意：Bean名称需保持为jasyptStringEncryptor，确保Spring Boot自动识别并替换默认加密器。

2. 实现EnvironmentPostProcessor #

在应用启动早期注入加密密码，确保配置文件加载前密码已生效，适合需要优先覆盖配置的场景：

import org.springframework.boot.SpringApplication;
import org.springframework.boot.env.EnvironmentPostProcessor;
import org.springframework.core.env.ConfigurableEnvironment;
import org.springframework.core.env.MapPropertySource;

import java.util.HashMap;
import java.util.Map;

public class JasyptPasswordProcessor implements EnvironmentPostProcessor {

    @Override
    public void postProcessEnvironment(ConfigurableEnvironment environment, SpringApplication application) {
        String encryptPwd = getEncryptPasswordFromCustomSource();
        Map<String, Object> props = new HashMap<>();
        props.put("jasypt.encryptor.password", encryptPwd);
        
        // 将密码加入环境变量，优先级高于配置文件
        environment.getPropertySources().addFirst(new MapPropertySource("jasyptCustomPwd", props));
    }

    private String getEncryptPasswordFromCustomSource() {
        // 示例：从本地密钥文件读取，可替换为实际逻辑
        return "your-custom-encrypt-password";
    }
}

需在src/main/resources/META-INF/spring.factories中注册该处理器：

org.springframework.boot.env.EnvironmentPostProcessor=com.yourpackage.JasyptPasswordProcessor

3. 手动实例化Encryptor解密 #

如果仅需对特定加密值手动解密，可直接创建Encryptor实例处理：

import org.jasypt.encryption.pbe.PooledPBEStringEncryptor;

public class JasyptManualDecrypt {
    public static void main(String[] args) {
        PooledPBEStringEncryptor encryptor = new PooledPBEStringEncryptor();
        encryptor.setPassword("your-encrypt-password");
        String encryptedValue = "ENC(xxx...)"; // 配置文件中的加密内容
        String decryptedValue = encryptor.decrypt(encryptedValue.replace("ENC(", "").replace(")", ""));
        System.out.println(decryptedValue);
    }
}

内容的提问来源于stack exchange，提问作者weili