Why Your Encrypted Config Loses ‘+’ and ‘=’ with curl – and How to Fix It

When encrypting or decrypting configuration values with Spring Cloud Config's /encrypt and /decrypt endpoints, special characters such as “=”, “+” may disappear because curl’s default -d option does not URL‑encode the data.

Root cause and fix

If you are testing with curl, use --data-urlencode (instead of -d ) or set an explicit Content-Type: text/plain header so that curl sends the data correctly when special characters are present.

Correct curl commands:

$ curl localhost:7001/encrypt --data-urlencode "eF34+5edo="
# returns eF34... (encrypted string)

$ curl localhost:7001/decrypt --data-urlencode "335e618a02a0ff3dc1377321885f484fb2c19a499423ee7776755b875997b033"
# returns eF34+5edo=

When building your own client, the following OkHttp example demonstrates how to call the encrypt and decrypt endpoints while preserving special characters.

private String encrypt(String value) {
    String url = "http://localhost:7001/encrypt";
    Request request = new Request.Builder()
        .url(url)
        .post(RequestBody.create(MediaType.parse("text/plain"), value.getBytes()))
        .build();
    Call call = okHttpClient.newCall(request);
    Response response = call.execute();
    ResponseBody responseBody = response.body();
    return responseBody.string();
}

private String decrypt(String value) {
    String url = "http://localhost:7001/decrypt";
    Request request = new Request.Builder()
        .url(url)
        .post(RequestBody.create(MediaType.parse("text/plain"), value.getBytes()))
        .build();
    Call call = okHttpClient.newCall(request);
    Response response = call.execute();
    ResponseBody responseBody = response.body();
    return responseBody.string();
}

Using the --data-urlencode option or explicitly setting the content type ensures that characters like “+” and “=” are transmitted unchanged, preventing data loss during encryption or decryption.