java-spring-basic authentication-如何对application.properties中定义的密码进行哈希

Question

Iam在application.Properties类中为Spring Boot应用程序实现基本身份验证，Iam在application.Properties类中定义凭据，但我想对密码进行哈希编码，然后检查哈希值是否与application.Properties中的密码哈希值相同，然后才能登录。如果可能的话，在configure方法中完成所有的逻辑，那就太好了。

应用程序.属性：

user.name=test
user.password={noop}example

SecurityConfig类：

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    private static final Logger logger = LoggerFactory.getLogger(SecurityConfig.class);

    private AuthenticationProvider authenticationProvider;

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.csrf().disable().authorizeRequests().anyRequest().authenticated().and().httpBasic()
                .and().sessionManagement().and().authenticationProvider(authenticationProvider)
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
    }

更新的代码

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    private static final Logger logger = LoggerFactory.getLogger(SecurityConfig.class);

    @Value("${security.user.password}")
    private String password;
    @Value("${security.user.name}")
    private String username;

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.csrf().disable().authorizeRequests().anyRequest().authenticated()
                .and().logout().and().httpBasic().and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);


    }

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().
                passwordEncoder(passwordEncoder()).withUser(username).password(password);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public String generateHashedPassword(String password) {
        return BCrypt.hashpw(password, BCrypt.gensalt(10));
    }
}

如果我输入了正确的用户名和密码，我就会登录，但是如果我设法使用application.properties中定义的用户名和密码登录，那么对密码进行散列又有什么意义呢？我想的更像是拥有一个散列键列表，并将输入密码与列表进行比较，如果成功，则登录。

Answer 1

由于您想在属性文件中定义您的凭据，我想您可以利用inmemory身份验证。请尝试以下操作：

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    private static final Logger logger = LoggerFactory.getLogger(SecurityConfig.class);

    private AuthenticationProvider authenticationProvider;

    @Value("${user.name}") 
    private String userName;

    @Value("${user.password}") 
    private String userHashedPassword; // hashed password

    @Override
    protected void configure(HttpSecurity http) throws Exception {

    http.csrf().disable().authorizeRequests().anyRequest().authenticated().and().httpBasic()
            .and().sessionManagement().and().authenticationProvider(authenticationProvider)
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
    }

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception
    {
        auth
           .inMemoryAuthentication()
           .passwordEncoder(passwordEncoder())
           .withUser(userName)
           .password(userHashedPassword);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

请注意，在这种情况下，您的密码应该先用bcryptpasswordencoder加密，然后将其放入属性文件（您可以使用其encoder.encode（“password”）方法）。如果需要，也可以使用passwordencoder的任何其他实现。我还注意到您正在使用一些自定义的autenticationprovider。不确定它是如何工作的，因为您没有共享代码，也不确定它是否能与内存自校正相适应。但是，无论如何，我认为这是值得一试的，在你的情况下这是正确的方法。希望有帮助。