应用程序属性中的 Spring Boot 密码加密，这是可供选择的选项

Question

I followed the below links for encrypting the password in my application properties file.

http://www.technovillage.org/?p=187

https://www.ricston.com/blog/encrypting-properties-in-spring-boot-with-jasypt-spring-boot/

I am just wondering which option here is more safer keeping the jasypt.encryptor.password in the application properties(then someone will decrypt my encrypted password using encryptor password.)

Or I shall pass it as a jvm parameter while starting the application.

Just wanted thoughts. Thanks in advance

Answer 1

If you don't want to keep the real password in application.properties file to keep it as a secret, it wouldn't make any sense to keep the necessary information to decode it in there - you might just as well keep the decoded password there in that case. Thus passing it as a jvm parameter would be more safer - that way people who have access to the repository wouldn't have access to the password.