Hide/Mask Confidential Data In Spring REST Response

Question

I am creating a rest service using Spring REST+Spring Security. In few services I need to Hide/Mask data in response.

For example, I don't want anybody to see a user's password. So the password field should be empty or should not be present in response. I am using same DTO in request and list response. That's why could not remove attribute from DTO.

Similarly, account number should be masked as xxx-xxx-xxx-123 .

Is there any way in spring to achieve this? Or any common solution that could be applied on all entities/controller when ResponseEntity is returned (like Interceptor )?

Answer 1

In this case, you could use either @JsonIgnore, as already suggested, or projections. If you need more controle over response, you could implement your own Serializers as well.

Answer 2

If you want to mask only selected field, during logging and keep other field values as is. you can try this.

https://github.com/senthilaru/sp-util

 <dependency> <groupId>com.immibytes</groupId> <artifactId>sp-utils</artifactId> <version>1.0.0-RELEASE</version> </dependency>