Cryptography sensitive information using spring

Question

According to OWASP top 10 sensitive information like id need to be encrypted through the pass between clients and server. With spring how do that? I mean : Is it possible with spring and how ? How generate keys? Key vault needed (like oracle) or a key generator ?

---

edit:

Example :

I write an API : http://localhost:8080/Estate/api/estates/ {id}

User 'A' can access to id 12 but I should prevent to access to id 14,15,16 So for that i should encrypt id .

Answer 1

As security base for a webapp you probably want to use HTTPS.

You can force Spring Security to use HTTPS with a config like this:

<http>
  <intercept-url pattern="/**" access="ROLE_ANONYMOUS" requires-channel="https"/>
  ...
</http>

This doesn't setup HTTPS for you, you will need to do it in Tomcat or the servlet container you use.

For a public valid server you need to order a certificate from a security company, for internal and testing you can create keystore using for example Portecle .