如何使用 Spring 验证密码

Question

I have found out how to hash the password of some one and persist it in the database with SpringMVC:

BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
String pw = passwordEncoder.encode("test");

Now the question is, how I can verify the password coming from the request to let the user login my web app? After some research I saw, that there are a lot of ways to do this. Some solutions works with user roles.

What my webapps should do is to offer my users a login page where they can register (here I would persist the password with the code shown above). After registering they should be able to login, which means I need to verify the password from the login form. Is there any state of the art example out there?

Answer 1

This is how a raw password can be matched to an encoded one:

passwordEncoder.matches("rawPassword", user.getPassword()),

But as others say, coding Security on your own is cumbersome, and so I'd recommend using Spring Security instead. Yes, it does take effort to learn, but you can find good tutorials on it. Here is a unique tutorial on it (disclaimer: I'm the author).

Answer 2

This is what i use when i implement my own change password functionality in spring

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.stereotype.Service;

@Service
public class Utility {

   private static BCryptPasswordEncoder passwordEcorder = new BCryptPasswordEncoder();


   public String bcryptEncryptor(String plainText) {
       return passwordEcorder.encode(plainText);
   }

   public Boolean doPasswordsMatch(String rawPassword,String encodedPassword) {
      return passwordEcorder.matches(rawPassword, encodedPassword);
   }
}

then in code to match two password ie rawPassword = password1234 and encodedPassword = $2a$10$zxvEq8XzYEYtNjbkRsJEbukHeRx3XS6MDXHMu8cNuNsRfZJWwswDy

the code would be like (called on some autowired object of Utility class):

  doPasswordsMatch( rawPassword, encodedPassword );

this will return TRUE if passwords match, otherwise it will be FALSE

Answer 3

要验证用户输入的密码是否正确，请对他们输入的值使用相同的单向哈希，然后将其与之前的哈希值进行比较 - 如果它们相同，则输入的密码是正确的。

Answer 4

Authentication and authorization are not simple objectives in web apps.

Spring does have a security framework to help with this, however it is not simple to use.

I recommend that you evaluate the Apache Shiro security frame work (available through the ASF website) which does the best job so far of simplifying security for Spring and Java EE.

http://shiro.apache.org/

It has abstractions that enable you to authenticate from a custom store of user info. There are a number of online short authentication tutorials using Shiro that will help you out.