如何在 Spring MVC 中实现胡椒
我试图确保我的应用程序的安全，当我告诉自己应该实施辣椒时，这样密码是安全的。我还没有真正找到任何使用 spring-security 框架的解决方案，所以我想问一下是否可能。
I was trying to make my Application secure, when I tought to myself that I should implement peppers, so that the password is secure. I haven't really found any solutions using the spring-security framework, so I wanted to ask if it's even possible.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
根据 Spring Security >特点>>认证>密码存储
，Spring Security 提供了许多内置方法来对密码存储中的密码进行编码。事实上，您可以实现自己的编码方案。
查看现有的StandardPasswordEncoderjavadoc 我们看到它被描述为将密码、盐和秘密组合到加密哈希函数 (SHA-256) 的输入中。该秘密可以是“系统范围的”或特定于编码器的。您可以直接使用此类，也可以克隆并修改它。
但是
Spring 已弃用
StandardPasswordEncoder类。根据他们的说法，对加盐密码进行哈希处理的方法是不安全的，即使您添加了秘密；例如“辣椒”。根据他们的说法，更安全的方法是使用计算成本非常高（即速度慢）的函数来进行散列。他们提供了许多以这种方式工作的编码器；例如
BCryptPasswordEncoder、Argon2PasswordEncoder、Pbkdf2PasswordEncoder和SCryptPasswordEncoder。所以我的建议是：
不要使用
StandardPasswordEncoder。它已被弃用。不要尝试推出自己的基于椒盐的 Spring 密码编码方案。除了此类方案的系统弱点（这就是
StandardPasswordEncoder被弃用的原因）之外，您还面临着由于您自己的实现中的缺陷而注入额外弱点的风险；例如“pepper”秘密的处理。一定要使用 Spring 工程师开发、测试和支持的替代方案之一（见上文）。
According to Spring Security > Features > Authentication > Password Storage
, Spring Security provides a number of built-in ways to encode passwords in a password store. Indeed, you can implement your own encoding scheme.
Looking at the existing
StandardPasswordEncoderjavadoc we see that is described as combining the password, a salt and a secret in the input to a crypto hash function (SHA-256). The secret can be "system wide" or specific to the encoder. You could either use this class directly, or clone and modify it.HOWEVER
The
StandardPasswordEncoderclass has been deprecated by Spring. According to them, the approach of hashing a salted password is insecure, even when you add a secret; e.g. a "pepper".According to them, a more secure approach is to use a very computationally expensive (i.e. slow) function to do the hashing. They provide a number of encoders that work this way; e.g.
BCryptPasswordEncoder,Argon2PasswordEncoder,Pbkdf2PasswordEncoderandSCryptPasswordEncoder.So my advice would be:
Do not use
StandardPasswordEncoder. It is deprecated.Do not to try roll your own Spring password encoding scheme based on salts and peppers. In addition to the systemic weakness of such schemes (which is why
StandardPasswordEncoderis deprecated), you risk injecting extra weaknesses due to flaws in your own implementation; e.g. the handling of the "pepper" secret(s).Do use one of the alternatives (see above) that the Spring engineers have developed, tested and support.