Jasypt(Java Simplified Encryption)

0. 들어가면서

어플리케이션 설정에는 노출되어선 안 되는 민감한 정보들이 많습니다. 설정 파일에 데이터베이스 접속 정보가 평문(plain text)으로 작성되어 있다면, 설정 파일이 노출되는 것만으로도 치명적일 수 있습니다. Jasypt 라이브러리를 사용하면 한 단계 방어막을 추가할 수 있습니다. 간략하게 라이브러리를 소개하고 사용 방법을 알아보겠습니다.

1. Jasypt(Java Simplified Encryption)

Java 어플리케이션에서 쉽게 설정 파일의 속성 값들을 암호화, 복호화할 수 있는 라이브러리입니다. Java 언어를 사용하는 Spring 프레임워크도 Jasypt를 사용할 수 있습니다. 민감한 평문 정보를 암호화하고, 아래처럼 설정 값을 지정하면 어플리케이션이 실행될 때 자동으로 이를 복호화하여 사용합니다.

ENC(암호화 된 평문)

2. 예제 - 암호화 된 설정 값 사용하기

데이터베이스의 유저와 비밀번호 정보에 암호화 된 값을 사용한 예제 프로젝트를 통해 Jasypt 사용법을 알아보겠습니다.

2.1. 의존성(dependency) 추가

프레임워크에 따라 의존성이 다르므로 주의하여 추가합니다. 이번 예제 프로젝트에선 spring-boot 프레임워크를 사용하였습니다.

2.1.1. Spring-Boot 프레임워크 의존성 추가

• spring-boot 프레임워크를 사용하는 경우 다음과 같은 의존성을 사용합니다.
• @SpringBootApplication이나 @EnableAutoConfiguration 애너테이션을 사용해야 합니다.

    <dependency>
        <groupId>com.github.ulisesbocchio</groupId>
        <artifactId>jasypt-spring-boot-starter</artifactId>
        <version>3.0.4</version>
    </dependency>

2.1.2. Spring-MVC 프레임워크 의존성 추가

• spring-mvc 프레임워크의 사용하는 경우 다음과 같은 의존성을 사용합니다.
• @SpringBootApplication이나 @EnableAutoConfiguration 애너테이션을 사용하지 않습니다.

    <dependency>
        <groupId>com.github.ulisesbocchio</groupId>
        <artifactId>jasypt-spring-boot</artifactId>
        <version>3.0.4</version>
    </dependency>

• @EnableEncryptableProperties 애너테이션을 통한 설정 클래스를 추가해야 합니다.

@Configuration
@EnableEncryptableProperties
public class MyApplication {
    ...
}

2.2. Generate Encryptor

Jasypt 암호기(encryptor)를 만들 때 몇 가지 알아둘 내용이 있습니다.

2.2.1. 빈(bean) 이름 지정하기

빈 이름을 별도로 지정하지 않으면 기본적으로 jasyptStringEncryptor를 사용합니다. 필요하다면 설정을 통해 변경할 수 있습니다.

application.yml 파일

• jasypt.encryptor.bean 설정을 통해 사용하고 싶은 빈 이름을 지정합니다.

jasypt: 
  encryptor:
    bean: encryptorBean

빈 생성 코드

• 암호기를 만들 때 빈 이름을 설정한 이름으로 작성합니다.

    @Bean("encryptorBean")
    public StringEncryptor stringEncryptor() {
        ...
    }

2.2.2. Encryptor Configuration

암호기를 만들 때 옵션 값들을 지정할 수 있습니다.

• 비공개 키
• 암호화 알고리즘
• 인코딩(encoding) 타입
• 솔트(salt) 값 생성기
• 기타

비공개 키는 필수로 입력 받아야하는 값이고, 나머지는 별도 설정이 없다면 다음과 같은 기본 값을 사용합니다.

Key	Required	Default Value
jasypt.encryptor.password	True	-
jasypt.encryptor.algorithm	False	PBEWITHHMACSHA512ANDAES_256
jasypt.encryptor.key-obtention-iterations	False	1000
jasypt.encryptor.pool-size	False	1
jasypt.encryptor.provider-name	False	SunJCE
jasypt.encryptor.provider-class-name	False	null
jasypt.encryptor.salt-generator-classname	False	org.jasypt.salt.RandomSaltGenerator
jasypt.encryptor.iv-generator-classname	False	org.jasypt.iv.RandomIvGenerator
jasypt.encryptor.string-output-type	False	base64
jasypt.encryptor.proxy-property-sources	False	false
jasypt.encryptor.skip-property-sources	False	empty list

2.2.3. JasyptConfig 클래스

다음과 같이 암호기 빈을 만듭니다.

• 빈 이름은 기본 값을 사용합니다.
  • @Bean(“jasyptStringEncryptor”)
• 비공개 키를 프로그램에서 하드 코딩하지 않고 외부로부터 주입받습니다.
  • @Value(value = “${jasypt.secrete-key}”)
• 암호 알고리즘은 편의상 기본 값이 아닌 PBEWithMD5AndDES 방식을 사용합니다.
  • 외부 사이트에서 PBEWithMD5AndDES 알고리즘 방식으로 암호화 값을 생성할 수 있습니다.
  • https://www.devglan.com/online-tools/jasypt-online-encryption-decryption
• 풀 사이즈의 기본 값은 1이라고 문서에 적혀 있지만, 실제로 값이 없는 경우 예외가 발생하므로 1을 지정합니다.
  • https://github.com/ulisesbocchio/jasypt-spring-boot#password-based-encryption-configuration

package action.in.blog.config;

import org.jasypt.encryption.StringEncryptor;
import org.jasypt.encryption.pbe.PooledPBEStringEncryptor;
import org.jasypt.encryption.pbe.config.SimpleStringPBEConfig;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class JasyptConfig {

    @Bean("jasyptStringEncryptor")
    public StringEncryptor stringEncryptor(@Value(value = "${jasypt.secrete-key}") String secreteKey) {
        PooledPBEStringEncryptor encryptor = new PooledPBEStringEncryptor();
        SimpleStringPBEConfig config = new SimpleStringPBEConfig();
        config.setPassword(secreteKey);
        config.setAlgorithm("PBEWithMD5AndDES");
        config.setPoolSize(1);
        encryptor.setConfig(config);
        return encryptor;
    }
}

2.3. 평문 암호화하기

마지막으로 암호화 된 평문이 필요합니다. 이번 테스트에서 암호화, 복호화에 사용하는 비밀 키는 HelloWorld 문자열을 사용합니다.

2.3.1. 프로그램 실행

직접 만든 암호기를 사용해 암호화 된 평문을 추출합니다. 암호화 된 값을 생성한 이후 관련 코드는 제거합니다.

package action.in.blog.config;

import org.jasypt.encryption.StringEncryptor;
import org.jasypt.encryption.pbe.PooledPBEStringEncryptor;
import org.jasypt.encryption.pbe.config.SimpleStringPBEConfig;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class JasyptConfig {

    @Bean("jasyptStringEncryptor")
    public StringEncryptor stringEncryptor(@Value(value = "${jasypt.secrete-key}") String secreteKey) {
        PooledPBEStringEncryptor encryptor = new PooledPBEStringEncryptor();
        SimpleStringPBEConfig config = new SimpleStringPBEConfig();
        config.setPassword(secreteKey);
        config.setAlgorithm("PBEWithMD5AndDES");
        config.setPoolSize(1);
        encryptor.setConfig(config);
        return encryptor;
    }

    // 암호화 값 생성 및 확인 후 제거
    public static void main(String[] args) {
        StringEncryptor encryptor = new JasyptConfig().stringEncryptor("HelloWorld");
        System.out.println(encryptor.encrypt("root"));
        System.out.println(encryptor.encrypt("123"));
    }
}

실행 결과

rCnFZG4bfEfOSrYhVUh0pA==
xvEJVPJcJi8Ja1zeRhbX+w==

2.3.2. 외부 사이트 사용

외부 사이트에서 암호화 작업을 수행할 수 있습니다. 이 사이트에선 PBEWithMD5AndDES 암호화 알고리즘 방식을 사용합니다.

• 왼쪽 창에선 암호화, 오른쪽 창에선 복호화를 수행할 수 있습니다.
• 양방향 암호화 타입을 사용합니다.
• https://www.devglan.com/online-tools/jasypt-online-encryption-decryption

https://www.devglan.com/online-tools/jasypt-online-encryption-decryption

2.4. applicaiton.yml 파일

암호화 된 값을 사용하여 다음과 같이 설정을 변경하겠습니다.

• spring.database.username, spring.database.password 설정
  • ENC() 내부에 암호화 된 값을 넣습니다.
• jasypt.secrete-key 설정
  • 비밀 키는 컨테이너 실행 시 환경 변수로 주입 받습니다.
  • 비밀 키를 알면 암호화, 복호화가 가능하므로 배포 환경에서 컨테이너의 환경 변수로 이를 주입합니다.
  • 운영체제의 환경 변수나 배포 스크립트에서 JASYPT_SECRETE_KEY 변수 값을 제어합니다.

spring:
  datasource:
    url: jdbc:mysql://database-host:3306/mysql
    driver-class-name: com.mysql.cj.jdbc.Driver
    username: ENC(rCnFZG4bfEfOSrYhVUh0pA==)
    password: ENC(xvEJVPJcJi8Ja1zeRhbX+w==)
jasypt:
  secrete-key: ${JASYPT_SECRETE_KEY}

3. 어플리케이션 실행

도커 컴포즈(compose)를 사용하여 어플리케이션을 실행합니다. 도커 컴포즈에서 사용하는 실행 파일은 다음과 같습니다.

• MySQL 데이터베이스 설정
  • 컨테이너 이름은 database-host입니다.
  • 포트는 3306을 사용합니다.
  • 사용자는 기본적으로 제공하는 root를 사용합니다.
  • 비밀번호는 123으로 지정합니다.
  • healthcheck를 통해 데이터베이스가 정상적으로 기동되었는지 확인합니다.
• 어플리케이션 설정
  • 포트는 8080을 사용합니다.
  • 비밀 키를 HelloWorld 값으로 환경 변수를 통해 주입합니다.
  • mysql 컨테이너가 정상적으로 기동된 이후에 백엔드 어플리케이션을 기동합니다.
  • 배포에 실패하는 경우 재실행합니다.

version: '3.8'
services:
  mysql:
    image: mysql
    container_name: database-host
    ports:
      - '3306:3306'
    environment:
      - MYSQL_ROOT_PASSWORD=123
    healthcheck:
      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost"]
      timeout: 6s
      retries: 10
  backend:
    build: .
    ports:
      - '8080:8080'
    environment:
      - JASYPT_SECRETE_KEY=HelloWorld
    depends_on:
      mysql:
        condition: service_healthy
    restart: on-failure

컨테이너 실행 결과

• 도커 컴포즈 실행 순서 제어에 따라 MySQL 데이터베이스가 먼저 실행됩니다.
• 데이터베이스 기동 이후 어플리케이션이 실행됩니다.
• 암호화 된 설정 값을 사용하였음에도 자동화 된 Jasypt 설정 복호화를 통해 어플리케이션이 정상 실행됩니다.

$ docker-compose up

[+] Running 12/12
 ⠿ mysql Pulled                                                                                                                               16.9s
   ⠿ 5ed150ed0abe Pull complete                                                                                                                4.4s
   ⠿ 0fede58e17ac Pull complete                                                                                                                4.4s
   ⠿ 994a6ddd6efe Pull complete                                                                                                                4.5s
   ⠿ 028bda79779b Pull complete                                                                                                                4.7s
   ⠿ 426fbe9e56a2 Pull complete                                                                                                                4.8s
   ⠿ 1a00e58dd193 Pull complete                                                                                                                4.9s
   ⠿ 4a4f64494005 Pull complete                                                                                                                9.0s
   ⠿ fba8ab3534a7 Pull complete                                                                                                                9.0s
   ⠿ 2695938edf88 Pull complete                                                                                                               12.2s
   ⠿ 3754e2587bed Pull complete                                                                                                               12.3s
   ⠿ 1b9f154543e7 Pull complete                                                                                                               12.3s
[+] Building 14.3s (17/17) FINISHED
 => [internal] load build definition from Dockerfile                                                                                           0.0s
 => => transferring dockerfile: 32B                                                                                                            0.0s
 => [internal] load .dockerignore                                                                                                              0.0s
 => => transferring context: 2B                                                                                                                0.0s
 => [internal] load metadata for docker.io/library/openjdk:11-jdk-slim-buster                                                                  2.4s
 => [internal] load metadata for docker.io/library/maven:3.8.6-jdk-11                                                                          2.4s
 => [auth] library/openjdk:pull token for registry-1.docker.io                                                                                 0.0s
 => [auth] library/maven:pull token for registry-1.docker.io                                                                                   0.0s
 => [internal] load build context                                                                                                              0.0s
 => => transferring context: 2.32kB                                                                                                            0.0s
 => [maven_build 1/6] FROM docker.io/library/maven:3.8.6-jdk-11@sha256:805f366910aea2a91ed263654d23df58bd239f218b2f9562ff51305be81fa215        0.0s
 => [stage-1 1/3] FROM docker.io/library/openjdk:11-jdk-slim-buster@sha256:863ce6f3c27a0a50b458227f23beadda1e7178cda0971fa42b50b05d9a5dcf55    0.0s
 => CACHED [maven_build 2/6] WORKDIR /build                                                                                                    0.0s
 => CACHED [maven_build 3/6] COPY pom.xml .                                                                                                    0.0s
 => CACHED [maven_build 4/6] RUN mvn dependency:go-offline                                                                                     0.0s
 => [maven_build 5/6] COPY src ./src                                                                                                           0.7s
 => [maven_build 6/6] RUN mvn package -Dmaven.test.skip=true                                                                                  10.2s
 => CACHED [stage-1 2/3] WORKDIR /app                                                                                                          0.0s 
 => [stage-1 3/3] COPY --from=MAVEN_BUILD /build/target/*.jar ./app.jar                                                                        0.1s 
 => exporting to image                                                                                                                         0.2s 
 => => exporting layers                                                                                                                        0.1s 
 => => writing image sha256:002fdc29ecda3bdef24776598520871df5f58485b7750ee8139e01e143b54541                                                   0.0s 
 => => naming to docker.io/library/action-in-blog-backend                                                                                      0.0s 
[+] Running 3/2
 ⠿ Network action-in-blog_default      Created                                                                                                 0.0s
 ⠿ Container database-host             Created                                                                                                 0.0s
 ⠿ Container action-in-blog-backend-1  Created                                                                                                 0.0s
Attaching to action-in-blog-backend-1, database-host
database-host             | 2022-10-16 21:09:53+00:00 [Note] [Entrypoint]: Entrypoint script for MySQL Server 8.0.31-1.el8 started.
database-host             | 2022-10-16 21:09:53+00:00 [Note] [Entrypoint]: Switching to dedicated user 'mysql'
database-host             | 2022-10-16 21:09:53+00:00 [Note] [Entrypoint]: Entrypoint script for MySQL Server 8.0.31-1.el8 started.
database-host             | 2022-10-16 21:09:53+00:00 [Note] [Entrypoint]: Initializing database files
database-host             | 2022-10-16T21:09:53.743986Z 0 [Warning] [MY-011068] [Server] The syntax '--skip-host-cache' is deprecated and will be removed in a future release. Please use SET GLOBAL host_cache_size=0 instead.
database-host             | 2022-10-16T21:09:53.744055Z 0 [System] [MY-013169] [Server] /usr/sbin/mysqld (mysqld 8.0.31) initializing of server in progress as process 80
database-host             | 2022-10-16T21:09:53.749748Z 1 [System] [MY-013576] [InnoDB] InnoDB initialization has started.
database-host             | 2022-10-16T21:09:54.003780Z 1 [System] [MY-013577] [InnoDB] InnoDB initialization has ended.
database-host             | 2022-10-16T21:09:54.903934Z 6 [Warning] [MY-010453] [Server] root@localhost is created with an empty password ! Please consider switching off the --initialize-insecure option.
database-host             | 2022-10-16 21:09:57+00:00 [Note] [Entrypoint]: Database files initialized
database-host             | 2022-10-16 21:09:57+00:00 [Note] [Entrypoint]: Starting temporary server
database-host             | 2022-10-16T21:09:57.260099Z 0 [Warning] [MY-011068] [Server] The syntax '--skip-host-cache' is deprecated and will be removed in a future release. Please use SET GLOBAL host_cache_size=0 instead.
database-host             | 2022-10-16T21:09:57.261151Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.31) starting as process 131
database-host             | 2022-10-16T21:09:57.276495Z 1 [System] [MY-013576] [InnoDB] InnoDB initialization has started.
database-host             | 2022-10-16T21:09:57.382102Z 1 [System] [MY-013577] [InnoDB] InnoDB initialization has ended.
database-host             | 2022-10-16T21:09:57.585835Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.
database-host             | 2022-10-16T21:09:57.585891Z 0 [System] [MY-013602] [Server] Channel mysql_main configured to support TLS. Encrypted connections are now supported for this channel.
database-host             | 2022-10-16T21:09:57.587231Z 0 [Warning] [MY-011810] [Server] Insecure configuration for --pid-file: Location '/var/run/mysqld' in the path is accessible to all OS users. Consider choosing a different directory.
database-host             | 2022-10-16T21:09:57.603553Z 0 [System] [MY-011323] [Server] X Plugin ready for connections. Socket: /var/run/mysqld/mysqlx.sock
database-host             | 2022-10-16T21:09:57.603649Z 0 [System] [MY-010931] [Server] /usr/sbin/mysqld: ready for connections. Version: '8.0.31'  socket: '/var/run/mysqld/mysqld.sock'  port: 0  MySQL Community Server - GPL.
database-host             | 2022-10-16 21:09:57+00:00 [Note] [Entrypoint]: Temporary server started.
database-host             | '/var/lib/mysql/mysql.sock' -> '/var/run/mysqld/mysqld.sock'
database-host             | Warning: Unable to load '/usr/share/zoneinfo/iso3166.tab' as time zone. Skipping it.
database-host             | Warning: Unable to load '/usr/share/zoneinfo/leapseconds' as time zone. Skipping it.
database-host             | Warning: Unable to load '/usr/share/zoneinfo/tzdata.zi' as time zone. Skipping it.
database-host             | Warning: Unable to load '/usr/share/zoneinfo/zone.tab' as time zone. Skipping it.
database-host             | Warning: Unable to load '/usr/share/zoneinfo/zone1970.tab' as time zone. Skipping it.
database-host             | 
database-host             | 2022-10-16 21:09:59+00:00 [Note] [Entrypoint]: Stopping temporary server
database-host             | 2022-10-16T21:09:59.913131Z 10 [System] [MY-013172] [Server] Received SHUTDOWN from user root. Shutting down mysqld (Version: 8.0.31).
database-host             | 2022-10-16T21:10:01.142091Z 0 [System] [MY-010910] [Server] /usr/sbin/mysqld: Shutdown complete (mysqld 8.0.31)  MySQL Community Server - GPL.
database-host             | 2022-10-16 21:10:01+00:00 [Note] [Entrypoint]: Temporary server stopped
database-host             | 
database-host             | 2022-10-16 21:10:01+00:00 [Note] [Entrypoint]: MySQL init process done. Ready for start up.
database-host             | 
database-host             | 2022-10-16T21:10:02.142108Z 0 [Warning] [MY-011068] [Server] The syntax '--skip-host-cache' is deprecated and will be removed in a future release. Please use SET GLOBAL host_cache_size=0 instead.
database-host             | 2022-10-16T21:10:02.143212Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.31) starting as process 1
database-host             | 2022-10-16T21:10:02.148917Z 1 [System] [MY-013576] [InnoDB] InnoDB initialization has started.
database-host             | 2022-10-16T21:10:02.244817Z 1 [System] [MY-013577] [InnoDB] InnoDB initialization has ended.
database-host             | 2022-10-16T21:10:02.418373Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.
database-host             | 2022-10-16T21:10:02.418420Z 0 [System] [MY-013602] [Server] Channel mysql_main configured to support TLS. Encrypted connections are now supported for this channel.
database-host             | 2022-10-16T21:10:02.419584Z 0 [Warning] [MY-011810] [Server] Insecure configuration for --pid-file: Location '/var/run/mysqld' in the path is accessible to all OS users. Consider choosing a different directory.
database-host             | 2022-10-16T21:10:02.433803Z 0 [System] [MY-011323] [Server] X Plugin ready for connections. Bind-address: '::' port: 33060, socket: /var/run/mysqld/mysqlx.sock
database-host             | 2022-10-16T21:10:02.433871Z 0 [System] [MY-010931] [Server] /usr/sbin/mysqld: ready for connections. Version: '8.0.31'  socket: '/var/run/mysqld/mysqld.sock'  port: 3306  MySQL Community Server - GPL.
action-in-blog-backend-1  | 
action-in-blog-backend-1  |   .   ____          _            __ _ _
action-in-blog-backend-1  |  /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \
action-in-blog-backend-1  | ( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
action-in-blog-backend-1  |  \\/  ___)| |_)| | | | | || (_| |  ) ) ) )
action-in-blog-backend-1  |   '  |____| .__|_| |_|_| |_\__, | / / / /
action-in-blog-backend-1  |  =========|_|==============|___/=/_/_/_/
action-in-blog-backend-1  |  :: Spring Boot ::                (v2.7.4)
action-in-blog-backend-1  | 
action-in-blog-backend-1  | 2022-10-16 21:10:25.058  INFO 1 --- [           main] action.in.blog.ActionInBlogApplication   : Starting ActionInBlogApplication v0.0.1-SNAPSHOT using Java 11.0.16 on 65972353bc86 with PID 1 (/app/app.jar started by root in /app)
action-in-blog-backend-1  | 2022-10-16 21:10:25.061  INFO 1 --- [           main] action.in.blog.ActionInBlogApplication   : No active profile set, falling back to 1 default profile: "default"
action-in-blog-backend-1  | 2022-10-16 21:10:25.613  INFO 1 --- [           main] .s.d.r.c.RepositoryConfigurationDelegate : Bootstrapping Spring Data JPA repositories in DEFAULT mode.
action-in-blog-backend-1  | 2022-10-16 21:10:25.626  INFO 1 --- [           main] .s.d.r.c.RepositoryConfigurationDelegate : Finished Spring Data repository scanning in 4 ms. Found 0 JPA repository interfaces.
action-in-blog-backend-1  | 2022-10-16 21:10:25.848  INFO 1 --- [           main] ptablePropertiesBeanFactoryPostProcessor : Post-processing PropertySource instances
action-in-blog-backend-1  | 2022-10-16 21:10:25.849  INFO 1 --- [           main] c.u.j.EncryptablePropertySourceConverter : Skipping PropertySource configurationProperties [class org.springframework.boot.context.properties.source.ConfigurationPropertySourcesPropertySource
action-in-blog-backend-1  | 2022-10-16 21:10:25.850  INFO 1 --- [           main] c.u.j.EncryptablePropertySourceConverter : Skipping PropertySource servletConfigInitParams [class org.springframework.core.env.PropertySource$StubPropertySource
action-in-blog-backend-1  | 2022-10-16 21:10:25.850  INFO 1 --- [           main] c.u.j.EncryptablePropertySourceConverter : Skipping PropertySource servletContextInitParams [class org.springframework.core.env.PropertySource$StubPropertySource
action-in-blog-backend-1  | 2022-10-16 21:10:25.851  INFO 1 --- [           main] c.u.j.EncryptablePropertySourceConverter : Converting PropertySource systemProperties [org.springframework.core.env.PropertiesPropertySource] to EncryptableMapPropertySourceWrapper
action-in-blog-backend-1  | 2022-10-16 21:10:25.851  INFO 1 --- [           main] c.u.j.EncryptablePropertySourceConverter : Converting PropertySource systemEnvironment [org.springframework.boot.env.SystemEnvironmentPropertySourceEnvironmentPostProcessor$OriginAwareSystemEnvironmentPropertySource] to EncryptableSystemEnvironmentPropertySourceWrapper
action-in-blog-backend-1  | 2022-10-16 21:10:25.851  INFO 1 --- [           main] c.u.j.EncryptablePropertySourceConverter : Converting PropertySource random [org.springframework.boot.env.RandomValuePropertySource] to EncryptablePropertySourceWrapper
action-in-blog-backend-1  | 2022-10-16 21:10:25.852  INFO 1 --- [           main] c.u.j.EncryptablePropertySourceConverter : Converting PropertySource Config resource 'class path resource [application.yml]' via location 'optional:classpath:/' [org.springframework.boot.env.OriginTrackedMapPropertySource] to EncryptableMapPropertySourceWrapper
action-in-blog-backend-1  | 2022-10-16 21:10:26.152  INFO 1 --- [           main] o.s.b.w.embedded.tomcat.TomcatWebServer  : Tomcat initialized with port(s): 8080 (http)
action-in-blog-backend-1  | 2022-10-16 21:10:26.165  INFO 1 --- [           main] o.apache.catalina.core.StandardService   : Starting service [Tomcat]
action-in-blog-backend-1  | 2022-10-16 21:10:26.165  INFO 1 --- [           main] org.apache.catalina.core.StandardEngine  : Starting Servlet engine: [Apache Tomcat/9.0.65]
action-in-blog-backend-1  | 2022-10-16 21:10:26.232  INFO 1 --- [           main] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring embedded WebApplicationContext
action-in-blog-backend-1  | 2022-10-16 21:10:26.232  INFO 1 --- [           main] w.s.c.ServletWebServerApplicationContext : Root WebApplicationContext: initialization completed in 1131 ms
action-in-blog-backend-1  | 2022-10-16 21:10:26.296  INFO 1 --- [           main] c.u.j.filter.DefaultLazyPropertyFilter   : Property Filter custom Bean not found with name 'encryptablePropertyFilter'. Initializing Default Property Filter
action-in-blog-backend-1  | 2022-10-16 21:10:26.305  INFO 1 --- [           main] c.u.j.r.DefaultLazyPropertyResolver      : Property Resolver custom Bean not found with name 'encryptablePropertyResolver'. Initializing Default Property Resolver
action-in-blog-backend-1  | 2022-10-16 21:10:26.307  INFO 1 --- [           main] c.u.j.d.DefaultLazyPropertyDetector      : Property Detector custom Bean not found with name 'encryptablePropertyDetector'. Initializing Default Property Detector
action-in-blog-backend-1  | 2022-10-16 21:10:26.333  INFO 1 --- [           main] c.u.j.encryptor.DefaultLazyEncryptor     : Found Custom Encryptor Bean org.jasypt.encryption.pbe.PooledPBEStringEncryptor@10ded6a9 with name: jasyptStringEncryptor
action-in-blog-backend-1  | 2022-10-16 21:10:26.452  INFO 1 --- [           main] com.zaxxer.hikari.HikariDataSource       : HikariPool-1 - Starting...
action-in-blog-backend-1  | 2022-10-16 21:10:26.781  INFO 1 --- [           main] com.zaxxer.hikari.HikariDataSource       : HikariPool-1 - Start completed.
action-in-blog-backend-1  | 2022-10-16 21:10:26.818  INFO 1 --- [           main] o.hibernate.jpa.internal.util.LogHelper  : HHH000204: Processing PersistenceUnitInfo [name: default]
action-in-blog-backend-1  | 2022-10-16 21:10:26.858  INFO 1 --- [           main] org.hibernate.Version                    : HHH000412: Hibernate ORM core version 5.6.11.Final
action-in-blog-backend-1  | 2022-10-16 21:10:27.006  INFO 1 --- [           main] o.hibernate.annotations.common.Version   : HCANN000001: Hibernate Commons Annotations {5.1.2.Final}
action-in-blog-backend-1  | 2022-10-16 21:10:27.117  INFO 1 --- [           main] org.hibernate.dialect.Dialect            : HHH000400: Using dialect: org.hibernate.dialect.MySQL8Dialect
action-in-blog-backend-1  | 2022-10-16 21:10:27.314  INFO 1 --- [           main] o.h.e.t.j.p.i.JtaPlatformInitiator       : HHH000490: Using JtaPlatform implementation: [org.hibernate.engine.transaction.jta.platform.internal.NoJtaPlatform]
action-in-blog-backend-1  | 2022-10-16 21:10:27.325  INFO 1 --- [           main] j.LocalContainerEntityManagerFactoryBean : Initialized JPA EntityManagerFactory for persistence unit 'default'
action-in-blog-backend-1  | 2022-10-16 21:10:27.365  WARN 1 --- [           main] JpaBaseConfiguration$JpaWebConfiguration : spring.jpa.open-in-view is enabled by default. Therefore, database queries may be performed during view rendering. Explicitly configure spring.jpa.open-in-view to disable this warning
action-in-blog-backend-1  | 2022-10-16 21:10:27.745  INFO 1 --- [           main] o.s.b.w.embedded.tomcat.TomcatWebServer  : Tomcat started on port(s): 8080 (http) with context path ''
action-in-blog-backend-1  | 2022-10-16 21:10:27.747  INFO 1 --- [           main] u.j.c.RefreshScopeRefreshedEventListener : Refreshing cached encryptable property sources on ServletWebServerInitializedEvent
action-in-blog-backend-1  | 2022-10-16 21:10:27.747  INFO 1 --- [           main] CachingDelegateEncryptablePropertySource : Property Source systemProperties refreshed
action-in-blog-backend-1  | 2022-10-16 21:10:27.748  INFO 1 --- [           main] CachingDelegateEncryptablePropertySource : Property Source systemEnvironment refreshed
action-in-blog-backend-1  | 2022-10-16 21:10:27.748  INFO 1 --- [           main] CachingDelegateEncryptablePropertySource : Property Source random refreshed
action-in-blog-backend-1  | 2022-10-16 21:10:27.748  INFO 1 --- [           main] CachingDelegateEncryptablePropertySource : Property Source Config resource 'class path resource [application.yml]' via location 'optional:classpath:/' refreshed
action-in-blog-backend-1  | 2022-10-16 21:10:27.748  INFO 1 --- [           main] c.u.j.EncryptablePropertySourceConverter : Converting PropertySource server.ports [org.springframework.core.env.MapPropertySource] to EncryptableMapPropertySourceWrapper
action-in-blog-backend-1  | 2022-10-16 21:10:27.748  INFO 1 --- [           main] c.u.j.EncryptablePropertySourceConverter : Skipping PropertySource configurationProperties [class org.springframework.boot.context.properties.source.ConfigurationPropertySourcesPropertySource
action-in-blog-backend-1  | 2022-10-16 21:10:27.748  INFO 1 --- [           main] c.u.j.EncryptablePropertySourceConverter : Skipping PropertySource servletConfigInitParams [class org.springframework.core.env.PropertySource$StubPropertySource
action-in-blog-backend-1  | 2022-10-16 21:10:27.748  INFO 1 --- [           main] c.u.j.EncryptablePropertySourceConverter : Converting PropertySource servletContextInitParams [org.springframework.web.context.support.ServletContextPropertySource] to EncryptableEnumerablePropertySourceWrapper
action-in-blog-backend-1  | 2022-10-16 21:10:27.757  INFO 1 --- [           main] action.in.blog.ActionInBlogApplication   : Started ActionInBlogApplication in 3.168 seconds (JVM running for 3.511)

TEST CODE REPOSITORY

• https://github.com/Junhyunny/blog-in-action/tree/master/2022-10-16-jasypt

REFERENCE

• http://www.jasypt.org/
• https://github.com/ulisesbocchio/jasypt-spring-boot
• https://www.baeldung.com/spring-boot-jasypt
• https://www.devglan.com/online-tools/jasypt-online-encryption-decryption