From 99b6064dc7a0b754f97079a796132c2c46e19af9 Mon Sep 17 00:00:00 2001 From: Dave Syer Date: Fri, 18 Dec 2015 10:23:28 +0000 Subject: [PATCH] Some clarifications on encryption and multiple keys --- docs/src/main/asciidoc/spring-cloud-config.adoc | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/src/main/asciidoc/spring-cloud-config.adoc b/docs/src/main/asciidoc/spring-cloud-config.adoc index 6aeb9660..775f9aa4 100644 --- a/docs/src/main/asciidoc/spring-cloud-config.adoc +++ b/docs/src/main/asciidoc/spring-cloud-config.adoc @@ -508,15 +508,17 @@ are special characters ('+' is particularly tricky). Take the encrypted value and add the `{cipher}` prefix before you put it in the YAML or properties file, and before you commit and push it -to a remote, potentially insecure store. The `/encrypt` and `/decrypt` -endpoints also both accept paths of the form `/*/{name}/{profiles}` -which can be used to control cryptography per application (name) -and profile when clients call into the main Environment resource. +to a remote, potentially insecure store. + +The `/encrypt` and `/decrypt` endpoints also both accept paths of the +form `/*/{name}/{profiles}` which can be used to control cryptography +per application (name) and profile when clients call into the main +Environment resource. NOTE: to control the cryptography in this granular way you must also provide a `@Bean` of type `TextEncryptorLocator` that creates a different encryptor per name and profiles. The one that is provided -by default does not do this. +by default does not do this (so all encryptions use the same key). The `spring` command line client (with Spring Cloud CLI extensions installed) can also be used to encrypt and decrypt, e.g.