What is the standard for PROD database password in the Springboot fat jar application connecting a database

Question

I have a springboot application which connects to database, currently the database password is in plain text inside the application properties.

What is the standard for securely protecting password in PROD environment?

How to change the database password if the application password is inside the application properties which is built in as part of the JAR and especially when the application is live?

Answer 1

You could use jasypt to handle the encryption and then use Jasypt's Spring integration or this Jasypt Spring Boot Starter to wire it into Spring.

This will allow you to define an encrypted database password property, for example in application.properties e.g.

db.password=ENC(.....)

The other part of your question is:

How to change the database password if the application password is inside the application properties

You can do this by overring properties defined in your properties file with system properties. For example: -Ddb.password='....'. You could also define an additional properties source which is external to your JAR and can be edited at runtime. For example:

@PropertySources({
        @PropertySource(value = "classpath:/**.properties"),
        @PropertySource(value = "file:/some/external/directory/override.properties", ignoreResourceNotFound = true)
})
public class Application {
    // ...
}  

Creating the file /some/external/directory/override.properties and populating it with db.password=... would cause your application - on next restart - to use that property value.