Related Posts
Additional Posts in Technical Assistance
New to Fishbowl?
Download the Fishbowl app to
unlock all discussions on Fishbowl.
unlock all discussions on Fishbowl.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Download the Fishbowl app to unlock all discussions on Fishbowl.
Copy and paste embed code on your site

Scan your QR code to download
Fishbowl app on your mobile

What threat are you protecting against?
If the UI application is an SPA/PWA and if the client is compromised, then encryption keys are the least of your worries.
If you are looking for encrypting the encryption keys, then usage of the OS's password manager (KeyChain, etc.) is an option. That would mean that the device admin would need to unlock the password manager for the application to be usable.
If you are looking for in-memory protection of application data and keys (eg: if the application can run in a shared infrastructure on the cloud), then there are commercial solutions like Fortanix Runtime Protection. However, this is overkill for regular applications.
I am looking for in-flight encryption between angular SPA/PWA and spring boot application.
I understand. If the spring boot application is physically located on a different machine, TLS can be used for securing the communication channel. Is your concern about how to secure the symmetric encryption keys negotiated for TLS? If that is the case, then it is usually not something that developers worry about much. TLS keys do not get stored on disk. It is very hard for an attacker to get the keys from RAM, and it is simply not a threat that developers care about for 99.9% of applications.