<dependency>
  <groupId>org.springframework.cloud</groupId>
  <artifactId>spring-cloud-context</artifactId>
  <version>3.0.5</version>
</dependency>

encrypt:
  key: 123456789 #密鑰
  salt: abcdef #加密的內(nèi)容使用了加鹽處理
---
spring:
  cloud:
    decrypt-environment-post-processor:
      enabled: true #開(kāi)啟解密功能

custom:
  password:  123456

public static void main(String[] args) throws Exception {
  String key = "123456789" ;
  String salt = "abcdef" ;
  String text = "123123" ;
  KeyProperties keyProperties = new KeyProperties() ;
  keyProperties.setKey(key) ;
  keyProperties.setSalt(salt) ;
  String result = TextEncryptorUtils.createTextEncryptor(keyProperties, null).encrypt(text) ;
  System.out.println(result) ;
}

custom:
  password:  "{cipher}2a483a44681006be6f0730b1acb45325c6bd20abe37369ef4fdb52c2e194a365"

@Value("${custom.password}")
public String pwd ;
  
@GetMapping("/pwd")
public String pwd() {
  return pwd ;
}

public class DecryptEnvironmentPostProcessor extends AbstractEnvironmentDecrypt implements EnvironmentPostProcessor, Ordered {
  @Override
  public void postProcessEnvironment(ConfigurableEnvironment environment, SpringApplication application) {
    // 判斷是否開(kāi)啟了功能
    if (bootstrapEnabled(environment) || useLegacyProcessing(environment) || !isEnabled(environment)) {
      return;
    }
    // 如果環(huán)境中不存在TextEncryptor那么也不會(huì)開(kāi)啟
    if (!ClassUtils.isPresent("org.springframework.security.crypto.encrypt.TextEncryptor", null)) {
      return;
    }
    // 獲取當(dāng)前環(huán)境下的所有配置屬性
    MutablePropertySources propertySources = environment.getPropertySources();
    environment.getPropertySources().remove(DECRYPTED_PROPERTY_SOURCE_NAME);
    // 解密所有的配置屬性，這里也就是入口了
    Map<String, Object> map = TextEncryptorUtils.decrypt(this, environment, propertySources);
    if (!map.isEmpty()) {
      // 將解密后的配置添加到環(huán)境中（addFirst 表示了添加到具有最高優(yōu)先級(jí)的給定屬性源對(duì)象）
      propertySources.addFirst(new SystemEnvironmentPropertySource(DECRYPTED_PROPERTY_SOURCE_NAME, map));
    }
  }
  protected Boolean isEnabled(ConfigurableEnvironment environment) {
    // 獲取配置屬性值，是否開(kāi)啟功能
    return environment.getProperty("spring.cloud.decrypt-environment-post-processor.enabled", Boolean.class, true);
  }
}

public abstract class TextEncryptorUtils {
  static Map<String, Object> decrypt(AbstractEnvironmentDecrypt decryptor, ConfigurableEnvironment environment, MutablePropertySources propertySources) {
    // 獲取加解密服務(wù)接口
    TextEncryptor encryptor = getTextEncryptor(decryptor, environment);
    return decryptor.decrypt(encryptor, propertySources);
  }


  static TextEncryptor getTextEncryptor(AbstractEnvironmentDecrypt decryptor, ConfigurableEnvironment environment) {
    Binder binder = Binder.get(environment);
    // 將屬性配置以 ‘encrypt’開(kāi)頭的都綁定到KeyProperties對(duì)象中
    KeyProperties keyProperties = binder.bind(KeyProperties.PREFIX, KeyProperties.class).orElseGet(KeyProperties::new);
    // 檢查是否配置了encrypt.key 等核心的信息
    if (TextEncryptorUtils.keysConfigured(keyProperties)) {
      decryptor.setFailOnError(keyProperties.isFailOnError());
      // 檢查是否當(dāng)前CLASSPATH中是否存在RsaSecretEncryptor
      if (ClassUtils.isPresent("org.springframework.security.rsa.crypto.RsaSecretEncryptor", null)) {
        RsaProperties rsaProperties = binder.bind(RsaProperties.PREFIX, RsaProperties.class).orElseGet(RsaProperties::new);
        return TextEncryptorUtils.createTextEncryptor(keyProperties, rsaProperties);
      }
      // 如果你沒(méi)有使用及配置Rsa相關(guān)的，那么就會(huì)在這里創(chuàng)建加解密服務(wù)接口，這里跟蹤了下使用的是AES加密算法
      return new EncryptorFactory(keyProperties.getSalt()).create(keyProperties.getKey());
    }
    // no keys configured
    return new TextEncryptorUtils.FailsafeTextEncryptor();
  }
}

public class AbstractEnvironmentDecrypt {
  public static final String ENCRYPTED_PROPERTY_PREFIX = "{cipher}";
  protected Map<String, Object> decrypt(TextEncryptor encryptor, PropertySources propertySources) {
    Map<String, Object> properties = merge(propertySources);
    // 解密處理
    decrypt(encryptor, properties);
    return properties;
  }
  protected void decrypt(TextEncryptor encryptor, Map<String, Object> properties) {
    // 開(kāi)始替換所有以{cipher}開(kāi)頭的屬性值
    properties.replaceAll((key, value) -> {
      String valueString = value.toString();
      if (!valueString.startsWith(ENCRYPTED_PROPERTY_PREFIX)) {
        return value;
      }
      // 解密數(shù)據(jù)， key 配置屬性的key， valueString要解密的數(shù)據(jù)
      return decrypt(encryptor, key, valueString);
    });
  }
  protected String decrypt(TextEncryptor encryptor, String key, String original) {
    // 截取{cipher}之后的內(nèi)容
    String value = original.substring(ENCRYPTED_PROPERTY_PREFIX.length());
    try {
       // 解密數(shù)據(jù)
      value = encryptor.decrypt(value);
      return value;
    } catch (Exception e) {
      // ...
      return "";
    }
  }
}