21.11.11 TIL

오늘의 삽질

Jasypt를 사용하여 application.properties 암호화 하기

Jasypt 라이브러리는 스프링 어플리케이션을 개발할 때 프로퍼티에 대한 암호화 기능을 제공한다.

참고 : https://github.com/ulisesbocchio/jasypt-spring-boot#use-you-own-custom-encryptor

Simply add the starter jar dependency to your project if your Spring Boot application uses @SpringBootApplication or @EnableAutoConfiguration and encryptable properties will be enabled across the entire Spring Environment (This means any system property, environment property, command line argument, application.properties, application-*.properties, yaml properties, and any other property sources can contain encrypted properties):

설명에 나온대로라면 우리는 @SpringBootApplication 어노테이션을 사용하므로 의존성만 추가하면 된다.

build.gradle

        //jasypt
    implementation "com.github.ulisesbocchio:jasypt-spring-boot-starter:3.0.4"

JasyptConfig 클래스

@Configuration
public class JasyptConfig {

    @Value("${jasypt.encryptor.password}")
    private String password;

    @Bean("jasyptStringEncryptor")
    public StringEncryptor stringEncryptor() {
        PooledPBEStringEncryptor encryptor = new PooledPBEStringEncryptor();
        SimpleStringPBEConfig config = new SimpleStringPBEConfig();
        config.setPassword(password);
        config.setAlgorithm("PBEWithMD5AndDES");
        config.setKeyObtentionIterations("1000");
        config.setPoolSize("1");
        config.setProviderName("SunJCE");
        config.setSaltGeneratorClassName("org.jasypt.salt.RandomSaltGenerator");
        config.setStringOutputType("base64");
        encryptor.setConfig(config);
        return encryptor;
    }
}

암호화한 application.properties 작성

아래 사이트에서 암호화할 수 있다.
https://www.devglan.com/online-tools/jasypt-online-encryption-decryption
암호화된 값은 ENC()로 묶는다.

server.port=8081

spring.datasource.url=ENC(ZaZRlXvDp82JKaMzPc1IMPYHUCkuEmf4x2bedOcNvBN8r0wFeHQOhIPmouNFSr6TFJuhjeFqysa1lkK4HlkyZOE0lh4MEPAuY6wSbNbMIMOs6mPIRM4FSIXbm2vx3BnYmJzavEOCfss=)
spring.datasource.username=ENC(AqoZVSAycgK2jz8IfHRd3fe9YXrwcHNq)
spring.datasource.password=ENC(NNDLkPxvpE6ws2IbIJclimVOg9Jf/UZy)
spring.jpa.hibernate.ddl-auto=create
spring.jpa.show-sql=true

oauth2.google.client_id=ENC(hGYp95LOdBXMJFKUpgEmqF4MKbx6FctY5twlX8qDX/Ec6j6HKrLkwzejQf6wlBdqH7udXBlNbYaSFzp09hOj2lBdDQIIo3qYD63Xco+AMwmTdAg6qYnkvQ==)
oauth2.google.client_secret=ENC(OR7yVMZvamqvzvc3Izm0z2By/gyXr2x/b8X/3CqRZDZU2P9tFqWI/MzMH+SkBQF7)
oauth2.kakao.client_id=ENC(j9nCp5sYnpnevg3oj2xLXu7CSXlyfnf8k/4BLMdOHYLUUEoP3uyJsoKYs6mLz5cy)
oauth2.naver.client_id=ENC(9owEZqVgw0pVXt4vlwIZFgtd7nmhptY+Ik83MuJUy54=)
oauth2.naver.client_secret=ENC(yXuqFBsbQ6cdXHrlYPRRDNFsqW0VN4LG)

java 실행시 암호화에 사용한 password를 파라미터로 전달한다.

-Djasypt.encryptor.password=mykey