'Why us Spring security password (instead of hash) baked into the documentation and code?
Why do Spring Security documentation and implementation rely on password and not password hash?
Isn't it a major security issue, that might cause issues in many products? Thanks.
Solution 1:[1]
Your understanding is wrong. The fact that something is called getPassword or the field password doesn't mean it isn't encrypted.
By default passwords are hashed using BCrypt in Spring Security. This is done through the BCryptPasswordEncoder. So what is stored (if anything is stored!) depends on the actual PasswordEncoder in use, next to ofcourse the authentication mechanism in use (for instance if you use X509 this would be empty).
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | M. Deinum |