Encryption at Rest and in Transit

package io.thecodeforge.security;

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

/**
 * Production-grade Security Configuration for io.thecodeforge
 * Forces HTTPS and sets Strict-Transport-Security (HSTS) headers.
 */
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .requiresChannel()
            .anyRequest()
            .requiresSecure() // Redirects all HTTP traffic to HTTPS
            .and()
            .headers()
            .httpStrictTransportSecurity()
            .includeSubDomains(true)
            .maxAgeInSeconds(31536000); // 1 Year HSTS policy
    }
}

// Pro-Tip: When using RestTemplate or WebClient to call external APIs,
// never disable SSL verification. Use a proper TrustStore if dealing with
// private CA certificates.

package io.thecodeforge.security;

import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import java.util.Base64;

/**
 * Field-Level Encryption Utility
 * Standard: AES/GCM/NoPadding (Production recommended over ECB/CBC)
 */
public class EncryptionService {

    private static final String ALGORITHM = "AES";
    // In production, retrieve this key from AWS KMS or HashiCorp Vault
    private byte[] encryptionKey = System.getenv("DB_ENCRYPTION_KEY").getBytes();

    public String encrypt(String data) throws Exception {
        SecretKeySpec secretKey = new SecretKeySpec(encryptionKey, ALGORITHM);
        Cipher cipher = Cipher.getInstance(ALGORITHM);
        cipher.init(Cipher.ENCRYPT_MODE, secretKey);
        byte[] encryptedValue = cipher.doFinal(data.getBytes());
        return Base64.getEncoder().encodeToString(encryptedValue);
    }

    public String decrypt(String encryptedData) throws Exception {
        SecretKeySpec secretKey = new SecretKeySpec(encryptionKey, ALGORITHM);
        Cipher cipher = Cipher.getInstance(ALGORITHM);
        cipher.init(Cipher.DECRYPT_MODE, secretKey);
        byte[] decodedValue = Base64.getDecoder().decode(encryptedData);
        return new String(cipher.doFinal(decodedValue));
    }
}

// usage: entity.setSsn(encryptionService.encrypt(rawSsn));