How to Securely Encrypt Nacos Config Passwords in Spring Cloud Applications

Background

The company policy forbids plain‑text passwords in configuration files. The project uses Nacos as a configuration center via the

spring-cloud-starter-alibaba-nacos-config

package. A basic

bootstrap.yaml

might look like:

<code>spring:
  cloud:
    nacos:
      config:
        server-addr: <host>:<port>
        prefix: application
        group: shared
        namespace: xxx
        file-extension: yaml
        username: user
        password: plain_text_password
        ......
</code>

How can the

spring.cloud.nacos.config.password

be replaced with a password encrypted by the company’s internal algorithm?

Research

Inspecting the

spring-cloud-starter-alibaba-nacos-config

JAR reveals a

META-INF/spring.factories

entry:

<code>org.springframework.cloud.bootstrap.BootstrapConfiguration=\
com.alibaba.cloud.nacos.NacosConfigBootstrapConfiguration
......
</code>

This registers

NacosConfigBootstrapConfiguration

for automatic configuration during Spring Cloud’s bootstrap phase. Inside that class, configuration is obtained via

NacosConfigProperties

:

<code>@Configuration(proxyBeanMethods = false)
@ConditionalOnProperty(name = "spring.cloud.nacos.config.enabled", matchIfMissing = true)
public class NacosConfigBootstrapConfiguration {
    @Bean
    @ConditionalOnMissingBean
    public NacosConfigProperties nacosConfigProperties() {
        return new NacosConfigProperties();
    }
    ......
}
</code>

The

NacosConfigProperties

class reads properties from the environment, with a

@PostConstruct

method

init

that calls

overrideFromEnv

to populate fields such as

serverAddr

,

username

, and

password

. Because the bean is created with

@ConditionalOnMissingBean

, we can replace it with a custom implementation.

Implementation

We create a subclass that overrides

init

and applies the decryption logic after the original initialization:

<code>@ConfigurationProperties(NacosConfigProperties.PREFIX)
public class CustomNacosConfigProperties extends NacosConfigProperties {
    @Override
    @PostConstruct
    public void init() {
        super.init();
        if (!StringUtils.isEmpty(this.getPassword())) {
            // Call your password decryption logic
            this.setPassword(yourDecryptAlgorithm(this.getPassword()));
        }
    }
}
</code>

Next, we register this custom bean with highest precedence so it replaces the default:

<code>@Configuration
@ConditionalOnProperty(name = "spring.cloud.nacos.config.enabled", matchIfMissing = true)
@Order(Ordered.HIGHEST_PRECEDENCE)
public class CustomNacosBootstrapAutoConfig {
    @Bean
    @ConditionalOnMissingBean
    public NacosConfigProperties nacosConfigProperties() {
        return new CustomNacosConfigProperties();
    }
}
</code>

Finally, we add our auto‑configuration to

resources/META-INF/spring.factories

so Spring Cloud picks it up during bootstrap:

<code>org.springframework.cloud.bootstrap.BootstrapConfiguration=\
your.package.CustomNacosBootstrapAutoConfig
</code>

With this setup, the

spring.cloud.nacos.config.password

entry in

bootstrap.yaml

can contain the encrypted password, and the custom bean will automatically decrypt it at startup, satisfying the company’s security requirements.