Secure secrets configuration and usage

There are three main aspects of the secrets system:

1. Configuration of the secret service
2. Storing of the secret in some data model
3. Accessing the secret from the data model

Configuration of the secret service is done via environment variables, typically in your Tomcat context.xml file. The key and respective values are described in the table below:

Individual secret services could require additional configuration. Both the Database Secret Service and AWS Secret Service do require additional configuration.

Storage of secrets is done by adding a field to your data model of type com.psddev.cms.secret.Secret . Once this field is added, the Secret Service system automatically ensures that any data added by users to this field is encrypted by the default secret service that is configured.

If no default service is configured for the instance, the value will be stored as plain text in the database, and the user will be warned that the data is not securely stored. Once a secret service is configured, the data will be securely stored on the next save of the parent object.

import com.psddev.cms.secret.Secret;

public class AcmeApiServiceSettings extends Content {

    @DisplayName("API Key")
    @Required
    private Secret apiKey;

}

Once you have a Secret field on a data model, you can then access the unencrypted value of this secret. This is done by calling Secret#getSecret , which returns the unencrypted value as a string.

import java.util.Optional;

import com.psddev.cms.secret.Secret;

public class AcmeApiServiceSettings extends Content {

    @DisplayName("API Key")
    @Required
    private Secret apiKey;

    public boolean isValidApiKey(String providedKey) {
        return Optional.ofNullable(apiKey)
            .map(Secret::getSecret)
            .map(unencryptedSecret -> unencryptedSecret.equals(providedKey))
            .orElse(false);
    }
}