Backport encrypted property functionality from spring-cloud-config environment work [SPR-12635]

[spring-projects-issues]

Joshua White opened SPR-12635 and commented

The spring-cloud team has implemented a feature that allows users to encrypt properties, prefixing them with {cipher}. This feature is something that would be nice to have in the core spring framework for those that can't yet take advantage of boot. See the following code for reference:

There is Spring configuration support in spring-cloud-commons and also server-side support where encryption and decryption services are exposed as HTTP endpoints. Also see documentation.

---

Affects: 4.1.4

Issue Links:

• PropertySourcesPlaceholderConfigurer never calls "convertProperties" on merged properties [SPR-8928] #13568 PropertySourcesPlaceholderConfigurer never calls "convertProperties" on merged properties
• Add encryption support for PropertyPlaceholderConfigurer [SPR-10666] #15294 Add encryption support for PropertyPlaceholderConfigurer
• Allow the use of custom PropertySource annotations in @Configuration classes [SPR-8963] #13603 Allow the use of custom PropertySource annotations in @Configuration classes
• SEC-3123 Encrypted property value support

0 votes, 5 watchers

[spring-projects-issues]

Sam Brannen commented

Please note that this is related to the following issues.

• SEC-3123
• Allow the use of custom PropertySource annotations in @Configuration classes [SPR-8963] #13603
• PropertySourcesPlaceholderConfigurer never calls "convertProperties" on merged properties [SPR-8928] #13568
• Add encryption support for PropertyPlaceholderConfigurer [SPR-10666] #15294

[spring-projects-issues]

Rossen Stoyanchev commented

I've updated the Description where the links were broken.

As far as I can tell the Spring Cloud support depends on Spring Security. I'm not sure how crucial that dependency is but given that SEC-3123 was moved from SPR then is there anything that makes sense to be done in Spring Framework itself?

[spring-projects-issues]

Rob Winch commented

joshua white Thanks for creating this ticket. Since this is providing cryptography, I think this makes sense in Spring Security rather than being in Spring Framework. I'm guessing this is a duplicate of SEC-3123 as Rossen alludes to.