How to Secure API Calls with End-to-End Encryption Using Spring Boot

Introduction

In a front‑end/back‑end separated architecture, all business interactions rely on API calls, making the security of those calls critical.

How to Ensure API Data Security

Use HTTPS for transport encryption.

Sign requests to prevent parameter tampering.

Implement authentication checks for each request.

Apply SSL pinning in apps to block packet capture.

Encrypt both request and response payloads.

Other measures as needed.

Encrypting All Requests and Responses

By wrapping every request and response with AES encryption, intercepted data remains unreadable. A Spring Boot starter ( spring-boot-starter-encrypt ) provides this functionality.

GitHub repository: https://github.com/yinjihuan/spring-boot-starter-encrypt

Key configuration (16‑character key) and debug flag are set in application.properties:

spring.encrypt.key – 16‑character encryption key (must be 16 bytes).

spring.encrypt.debug – enable debug mode (default false); when true encryption is disabled.

Controllers enable encryption with @Encrypt and decryption with @Decrypt.

Front‑End Responsibilities

The front end must decrypt responses before rendering and encrypt POST payloads. A JavaScript utility (aes.js, crypto‑js.js, pad‑zeropadding.js) together with an Axios interceptor can handle this automatically.

Key Exchange Strategy

Combine RSA and AES: RSA encrypts the AES key during exchange, while AES encrypts the actual data, leveraging RSA’s security and AES’s performance.

Typical handshake:

Server generates RSA key pair (pubkey1, prikey1) and sends pubkey1 to the client.

Client generates its own RSA pair (pubkey2, prikey2), encrypts pubkey2 with pubkey1, and sends the ciphertext to the server.

Server decrypts with prikey1 to obtain pubkey2.

Server generates a random AES key, encrypts it with pubkey2, and returns the ciphertext to the client.

Client decrypts with prikey2 to obtain the AES key, then uses it for subsequent data encryption.

Spring‑Boot‑Starter‑Encrypt Internals

The @EnableEncrypt annotation imports an auto‑configuration class that registers RequestBodyAdvice and ResponseBodyAdvice beans to intercept and process request/response bodies.