春季启动密码编码

发布于 2025-02-03 18:35:38 字数 475 浏览 2 评论 0原文

我是Spring Boot的新手，我正在尝试为API配置安全性。我正在使用密码编码：

public static String encodePassword(String plainPassword){
    BCryptPasswordEncoder bCryptPasswordEncoder=new BCryptPasswordEncoder();
    return bCryptPasswordEncoder.encode(plainPassword);
}

在SecurityConfig类中，我得到了以下方法：

@Bean
public PasswordEncoder getPasswordEncoder(){
    return new BCryptPasswordEncoder();
}

但是每次给出相同的输入时，输出总是不同的，有人可以向我解释此原因的原因，以及如何解决此问题？

原文

I am new to Spring boot and I am trying to configure the security for my api. I am using PasswordEncoding:

public static String encodePassword(String plainPassword){
    BCryptPasswordEncoder bCryptPasswordEncoder=new BCryptPasswordEncoder();
    return bCryptPasswordEncoder.encode(plainPassword);
}

In the SecurityConfig class I got the following method:

@Bean
public PasswordEncoder getPasswordEncoder(){
    return new BCryptPasswordEncoder();
}

But each time given the same input the output is always different, can someone explain to me the reason behind this and how I can possibly fix this?

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

阿楠 2025-02-10 18:35:38

通过设计，您没有什么可以“修复”的。原因是因为BCRYPT算法包括盐，每次调用它时都会有所不同。这意味着，如果您试图将普通文本密码编码为哈希，并将其与另一个哈希进行比较，则它将不匹配。但是，您可以使用该方法，匹配，在bcryptpasswordencoder中进行比较。

这是一项在此处证明这一点的测试

@Test
public void encodeAndMatch() {
    BCryptPasswordEncoder bc = new BCryptPasswordEncoder();

    String p1 = bc.encode("password");
    String p2 = bc.encode("password");
    String p3 = bc.encode("password");
    
    assertNotEquals(p1, p2);
    assertNotEquals(p1, p3);
    assertNotEquals(p2, p3);

    assertTrue(bc.matches("password", p1));
    assertTrue(bc.matches("password", p2));
    assertTrue(bc.matches("password", p3));
}

，您可以看到相同的密码生成了三个不同的哈希，但是编码器仍然可以将原始的普通文本密码与每个密码进行比较并匹配。

This is by design, there's nothing for you to "fix". The reason is because the BCrypt algorithm includes a salt, which will be different every time you call it. What this means is that if you're trying to encode a plain-text password to a hash and compare it to another hash, it's not going to match. You can, however, use the method, matches, in BCryptPasswordEncoder to compare.

Here's a test that demonstrates this

@Test
public void encodeAndMatch() {
    BCryptPasswordEncoder bc = new BCryptPasswordEncoder();

    String p1 = bc.encode("password");
    String p2 = bc.encode("password");
    String p3 = bc.encode("password");
    
    assertNotEquals(p1, p2);
    assertNotEquals(p1, p3);
    assertNotEquals(p2, p3);

    assertTrue(bc.matches("password", p1));
    assertTrue(bc.matches("password", p2));
    assertTrue(bc.matches("password", p3));
}

Here you can see that the same password generated three distinct hashes, but the encoder can still compare the original plain-text password to each of them and match.

回复收藏 0 原文

~没有更多了~