Spring Security JDBC Authentication with Password Encryption
I published a basic level tutorial on how to implement JDBC Authentication and Authorization using Spring Security last week. There a...

https://www.programming-free.com/2015/09/spring-security-password-encryption.html
I published a basic level tutorial on how to implement JDBC Authentication and Authorization using Spring Security last week. There are few best practices to be followed while implementing security. One such important thing to do is Password Encryption and I am going to cover all this in this article.
I updated the project I implemented for the previous tutorial to cover the following best practices,
1. Edited mysql queries to use userid as foreign key instead of username. This will help in case if the username needs to be changed in future.
2. Replaced passwords in database that are stored as plain text with encrypted passwords. This is very very important. If the database ever gets hacked, all the plain text passwords will be exposed and that would be a great disaster. So, passwords must be encrypted with a good hashing algorithm which will be very hard for any hacker to crack. Spring Security supports one of the best password hashing algorithm which is bcrypt. I found an interesting article about using bcrypt here, you can read it if you want to have a quick look at what this is.
3. Used Spring Security's default BCryptPassword Encoder to handle bcrypt encoded passwords.
4. Separated database, authentication and authorization related configuration from mvc configuration.
Let me now go step by step and explain the changes to be made.
1. First download the existing project from here.
2. Execute below mysql queries,
DROP TABLE IF EXISTS users; DROP TABLE IF EXISTS user_roles; CREATE TABLE users ( userid VARCHAR(5) NOT NULL, username VARCHAR(45) NOT NULL , password VARCHAR(60) NOT NULL , enabled TINYINT NOT NULL DEFAULT 1 , PRIMARY KEY (userid)); CREATE TABLE user_roles ( user_role_id int(11) NOT NULL AUTO_INCREMENT, userid varchar(5) NOT NULL, role varchar(45) NOT NULL, PRIMARY KEY (user_role_id), UNIQUE KEY uni_username_role (role,userid), KEY fk_username_idx (userid), CONSTRAINT fk_username FOREIGN KEY (userid) REFERENCES users (userid)); INSERT INTO users(userid,username,password,enabled) VALUES ('001','priya','$2a$04$CO93CT2ObgMiSnMAWwoBkeFObJlMYi/wzzOnPlsTP44r7qVq0Jln2', true); INSERT INTO users(userid,username,password,enabled) VALUES ('002','naveen','$2a$04$j3JpPUp6CTAe.kMWmdRNC.Wie58xDNPfcYz0DBJxWkucJ6ekJuiJm', true); INSERT INTO user_roles (userid, role) VALUES ('002', 'ROLE_USER'); INSERT INTO user_roles (userid, role) VALUES ('001', 'ROLE_ADMIN'); INSERT INTO user_roles (userid, role) VALUES ('001', 'ROLE_USER');
Note that I have converted plain text passwords to encrypted passwords. I used this online bcrypt calculator for converting the passwords to bcrypt encoded hash values. You can do the same or use this small utility method to find out,
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; public class EncryptPassword{ public static void main(String args[]) throws Exception { String cryptedPassword = new BCryptPasswordEncoder().encode("password"); System.out.println(cryptedPassword); } }
3. Add a new class in hello package to have all authentication related configuration to have a better clarity,
AuthenticationProvider.java
package hello; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.jdbc.datasource.DriverManagerDataSource; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl; @Configuration public class AuthenticationProviderConfig { @Bean(name = "dataSource") public DriverManagerDataSource dataSource() { DriverManagerDataSource driverManagerDataSource = new DriverManagerDataSource(); driverManagerDataSource.setDriverClassName("com.mysql.jdbc.Driver"); driverManagerDataSource.setUrl("jdbc:mysql://localhost:3306/userbase"); driverManagerDataSource.setUsername("root"); driverManagerDataSource.setPassword("root"); return driverManagerDataSource; } @Bean(name="userDetailsService") public UserDetailsService userDetailsService(){ JdbcDaoImpl jdbcImpl = new JdbcDaoImpl(); jdbcImpl.setDataSource(dataSource()); jdbcImpl.setUsersByUsernameQuery("select username,password, enabled from users where username=?"); jdbcImpl.setAuthoritiesByUsernameQuery("select b.username, a.role from user_roles a, users b where b.username=? and a.userid=b.userid"); return jdbcImpl; } }
4. Remove datasource configuration from MvcConfig.java. MvcConfig must now look clean with only mvc related configuration like this,
MvcConfig.java
package hello; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.web.servlet.config.annotation.ViewControllerRegistry; import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter; import org.springframework.web.servlet.view.InternalResourceViewResolver; @Configuration public class MvcConfig extends WebMvcConfigurerAdapter{ @Override public void addViewControllers(ViewControllerRegistry registry) { registry.addViewController("/home").setViewName("home"); registry.addViewController("/").setViewName("home"); registry.addViewController("/hello").setViewName("hello"); registry.addViewController("/login").setViewName("login"); registry.addViewController("/403").setViewName("403"); } @Bean public InternalResourceViewResolver viewResolver() { InternalResourceViewResolver resolver = new InternalResourceViewResolver(); resolver.setPrefix("/WEB-INF/jsp/"); resolver.setSuffix(".jsp"); return resolver; } }
5. Now add password encoder to security configuration class.
WebSecurityConfig.java
package hello; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; @Configuration @EnableWebMvcSecurity public class WebSecurityConfig extends WebSecurityConfigurerAdapter { @Autowired UserDetailsService userDetailsService; @Autowired public void configAuthentication(AuthenticationManagerBuilder auth) throws Exception { auth.userDetailsService(userDetailsService).passwordEncoder(passwordencoder());; } @Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests() .antMatchers("/hello").access("hasRole('ROLE_ADMIN')") .anyRequest().permitAll() .and() .formLogin().loginPage("/login") .usernameParameter("username").passwordParameter("password") .and() .logout().logoutSuccessUrl("/login?logout") .and() .exceptionHandling().accessDeniedPage("/403") .and() .csrf(); } @Bean(name="passwordEncoder") public PasswordEncoder passwordencoder(){ return new BCryptPasswordEncoder(); } }
Its very simple. Just create an object of Spring Security's default BCryptPasswordEncoder, set it to the AuthenticationManagerBuilder and we are done!
The user will type plain text for password on the website, spring security validates the bcrypt encoded version of the password entered by the user.
You can download this updated project from the link below.
Good Article
ReplyDeleteplease post spring mvc with maven and db connectivity program
ReplyDeleteXML Code Examples
ReplyDeleteHi This is very good example and works well. I am just new and learning this. How can i add a new regisration page after welcome page. I created jsp and made mvc config changes but not sure how to change settings in websecurityconfig.java. can you please help me
ReplyDeletecrazykrush is new dating apps free for dating with other people
ReplyDeleteGreat post very useful info thanks for this post ....
ReplyDeleteAws training chennai | AWS course in chennai
Rpa training in chennai | RPA training course chennai
sas training in chennai | sas training class in chennai
Statistics Assignment Help
ReplyDeletestatistics help
Statistics Homework Help
statistics homework
statistics homework helper
Help With SPSS
SPSS Help
SPSS assignment help
SPSS Homework Help
matlab homework help
matlab assignment help
help with matlab homework
help with matlab assignment
ReplyDeletematlab assignment help australia
stata homework help
probability assignment
probability assignment help
R Programming homework help
Bio Statistics Assignment Help
rstudio assignment help
r homework help
r assignment help
help with r assignment
rstudio homework help
r homework assignments
r programming help
r assignments
do my r homework
r programming homework
r help online
r studio tutor
R Programming assignment Help
R Programming homework help
business statistics assignment help
business statistics homework help
data analysis assignment help
data mining assignment help
Amazing Article
ReplyDeleteinternship in chennai
internship in chennai for cse
internship for mba in chennai
internship in chennai for hr
internship in chennai for mba
companies for internship in chennai
internship in chennai for ece
paid internship in chennai
internship in chennai for biotechnology
internship in chennai for b.com students
Thanks for sharing such a nice info.I hope you will share more information like this. please keep on sharing!
ReplyDeleteInplant training in chennai
Inplant training in chennai for cse
Inplant training in chennai for ece
Inplant training in chennai for mechanical
Inplant training in chennai for ece students
Inplant training in chennai for eee
Inplant training in bmw chennai
Thanks for sharing this, I actually appreciate you taking the time to share with everybody.
ReplyDeleteBest Data Science Course In Hyderabad
business assignment help
ReplyDeletedo my business assignment
python assignment help
ReplyDeleteenglish homework help
ReplyDeleteexcel assignment help
ReplyDeleteUse Assignment Helper administrations in the event that you don't discover anything to form your scholarly paper or schoolwork. Now and again, you can't focus on your investigations in view of being occupied with numerous exercises and discover hard to compose your assignment.
ReplyDeleteWe are the best website for providing Programming Assignment Help. Our years of knowledgeable team experts will help and guide students regarding their assignments.
ReplyDeleteProgramming Assignment Help
This is great. Brother Printer Drivers. Thank you so much.
ReplyDeleteOur online assignment help Australia service is an online assignment help service provided by experienced Australian assignment help expert at here.
ReplyDeleteGriffith University Assignment Help
La Trobe University Homework Help
Southern Cross University Homework Help
University Of Tasmania Assignment Help
Australian Catholic University Assignment Help
Charles Sturt University Assignment Help
Federation University Assignment Help
Don’t be a fool to take assistance from any writing services because most writing websites are providing uneducated writers who are unknown with the aspects of writing that’s why the majority of the students are falling in their academic paper. In this scenario, students should contact academic service who are fully aware of the aspects of an academic paper and also resolves the inquiry of the student for years.
ReplyDeleteProgramming assignment help
ReplyDeleteAre you tired after a lot of attempts? Since most of the students are falling down in their papers due to incomplete knowledge that’s why they found helping hands of homework help writers gulf who are professional in the field of academic writing and also known with the aspects of it. Furthermore, they enjoy the best discount offers offered by them and also receive the required paper at the given deadline.
ReplyDeletePrepare to harvest your audience information from user registration to live comments, post comments or questions asked during the session.assignment expert
ReplyDeleteKuchi Jewels is a project of Gem & Gems which is a leading exporter since 2005 to onwards in all over the world. Our company has experienced, educated and motivated staff. Our main goal is to meet the international standard B2C and B2B export target with competitive prices and high quality products. pearl necklace canada , pearl necklace australia
ReplyDeletehappy birthday message for employee
ReplyDeleteGlobal Translation Help is a USA-based translation company that provides Academic Document Translation Services all over the world. We have a large team of ATA-certified translators who are able to provide international students with a certified letter accompanying each of our translations. Our specialist academic translators have years of experience to translate academic documents, such as assignments, case studies, and many others in more than 200 languages. To get the best academic translation services, don’t think twice and contact us.
ReplyDeleteI am reading it with keen interest but is not difficult to reset password if you have encrypted it. Assignment writing services
ReplyDeleteGreat post! I am seeing the great contents and step by step read really nice information. I am gathered this concept and more information.
ReplyDeleteData Science Training in Hyderabad
Data Science Course in Hyderabad
I couldn't imagine a better Statistics Homework Help than the one administered to me by this expert. He got me a good grade at a very affordable price despite my short notice. And when I checked the order for plagiarism and noticed that it was 99% unique, I concluded that this is the best Statistics Assignment Help provider for me. He has enough experience and insight necessary to nail down challenging statistics tasks in time. I'll order from him frequently from today.
ReplyDeleteWhile others are recounting their fast delivery experiences, I'm here to raise a delay issue that I experienced with the previous order. But,The Matlab Assignment Help expert did want to respond to my questions about the progress of my order. In the end, he delivered the emergency order in twenty minutes. I was Happy to receive my Matlab Homework Help paper. You will try to cushion me with a small refund.
ReplyDeleteYou make remote learning look simple and smooth. I was assigned an experienced Economics Homework Help tutor that was very organized and punctual, leave alone straight to the point and slow enough for me to grasp the concepts. I must commend and recommend his invaluable services to all students looking for the same assistance as myself. I'll keep using your Economics Assignment Help until I get the best out of it. Meanwhile, cheers!
ReplyDeleteMost of the Java Assignment Help online isn't often up to conventionally excellent standards. But with them in the industry for several years, there's no doubt that they offer excellent programming help. To me, they are the best. The group of programmers behind the Programming Assignment Help website is more than amazing. I trust all of them because each time I always get my assignment done by a different expert without failing. Please continue in the same spirit.
ReplyDeleteThis comment has been removed by the author.
ReplyDeleteHello? May I know if you also have Ph.D Programming Homework Help tutors? If yes, I'd love to interact with one of them onlineJava Homework Help. Such an expert cannot fail anyone with his/her solutions. If you need extra pay for allowing me to have access to him/her, I'm ready to pay for it.
ReplyDeleteI forgot that I had an Statistics assignment that was almost due until a classmate asked me if I'd solved one of the questions that he'd found challenging. I'd also not studied sufficiently for the same assignment. So I asked forStatistics Assignment Help from the experts on statisticshomeworkhelper.com, and my order was awarded to this user. While he wasn't very communicative throughout the two days, he ended up sending me the best solutions that I'm sure will get me a leading grade. I recommend his Statistics Homework Help.
ReplyDeleteI need a few samples before I can use the Matlab Assignment Help service. I think that can help me evaluate their ability more accurately than just going by the reviews. It's my first time here, and I'm being cautious this way because I got conned on the previous website. If you're able to do so, kindly let me know so that I can place an order for them with Matlab Homework Help services ASAP.
ReplyDeleteThe Answer is Yes. We at Do My Homework Help are looking for opportunities to help you complete your homework on time so that you do not miss any of your assignment submissions. We are here to help you achieve balance in your life and make you enjoy what you like without worrying about completing your assignments. Our team is well educated and expert in writing different types of assignments and doing homework for all the fields, including commerce, Management, Accounting, Business, Science, Computer Science and many more.
ReplyDeletedomyhomework
Do you also want Assignment help? We lend expert writers for assisting you with the projects. Our qualified writers will assist you with everything. You will get 100% original content within the deadline. Hire our assignment helper online and finish your project works.
ReplyDeleteThis is a very useful and important information, it was so useful to me and other readers, thank you for always feeding the readers with interesting and useful information, your blog is indeed doing very well, kudos, meanwhile you can checkout this cut off mark for marine engineering in fupre
ReplyDeleteThis blog has enlightened me on what I suppose to know about. As a matter of fact, it has shown me the necessary steps I should take. You can still click here to see noun cut off mark for jamb
ReplyDeleteThanks for this amazing article, I believe it will be of great benefit to students also. Small Business Grants 2020
ReplyDeleteHi there, thank you for sharing such great informative post with us. It is really helpful.
ReplyDeleteWindows error code
Kernel_Security_Check_Error
ERR_CONNECTION_RESET" Error
ePSXe Black Screen problem
https //ij.start.cannon
ReplyDeleteInstall latest software and drivers of canon printer and plug in the USB cable to computer and printer. It’ll automatically be connected; however, you’ve to follow on-screen guidelines.
http //ij.start.canon
ij.start.canon
ReplyDeleteis the manufacturer site to download Canon printer drivers. Install and set up Canon Printer from https: //ij.start.canon and obtain high-quality printing documents straightforwardly.
https//ij.start.cannon is actually the official site of ij start canon that helps you install the latest printer drivers and software. Visiting http //ij.start.cannon
provides you a complete list of all canon printers where you’ve to select your printer model and download the correct setup file
Canon IJ Network Tool is a toolkit software with the options to keep a check on most of your Canon printer network settings and adjust them according to your requirements.
ReplyDeleteCanon IJ Printer Utility is a complete software package meant to adjust and modify the configurations of your printer device as per the requirement. It is one of the essential utility software offered by Canon to ease your printer configuration alteration using a few clicks.
Canon.com/ijsetup/mg2500
is the Canon support link to get you the latest printer drivers and software to set up your PIXMA MG2500 or MG2520.
This is a very unique and magnificent post with readable and informative content, I'm absolutely impressed. Thank you for sharing these amazing reads..... coeikwo departmental cut off mark
ReplyDeleteThis is a good time to make long term plans and it's timely.
ReplyDeleteHave fun. I have read this post, and if you will excuse me, I would like to advise you on interesting topics or tips.
You can write the following articles on this topic.
I want to read more topics on this topic!
english stories english short stories with moral value What is the factorial of 100
Nice...
ReplyDeleteIt's a very powerful article. I really like this post. Thank you so much for sharing this.
putlocker
kissanime
Dissertations are one of the hardest assignments that can be done. Its goal is to text the upper limits of a student's data gathering skills and knowledge. We at Dissertation help London provide the best of the best academic writing help available. With our hard working and experienced team of writers and scholars we can deliver the dissertations on time with high quality guarantee. Through this we have built our reputation of being the best online Dissertation help in London. Moreover, we have also become known for our affordable services that have enabled many students to be able to come to us for help.
ReplyDeleteundergraduate dissertation writing is a challenging procedure for college students in any situation. Simply put, we can assist you with your college dissertations, whether you need help with the whole thing or just a single part, like an annotated bibliography or a dissertation proposal. We create both completed dissertations and the parts that make them up. Each service is safe and secure. When placing an order through the British Dissertation Help official website ordering page, every customer enjoys a number of benefits. If you have any questions, you can always get in touch with our support team, which is available 24/7.
ReplyDeleteI often hear about different document translation agencies. It's great and makes people's lives easier. But recently I discovered a video translation and dubbing service - Service vidby. This is important to me because I'm one of those people who doesn't like subtitles because they distract from the plot of the video. Taking into account the fact that the time of machine voice acting is much less than for human voice acting, this saves time and money.
ReplyDeleteExcellent for this specific beneficial blog post. I am surprisingly happy to seek out this form of relevant information. lautech past questions and answers
ReplyDeleteThis comment has been removed by the author.
ReplyDeleteGreat Blogs,Every thing needs security,Thats whyLifeLong Wealth Managemet provide securing advising for your future
ReplyDeleteThis blog describe all major security points, Gladwell Care Canada is also secure patient with adult diapers
ReplyDeleteEVERYONE Get ready for #MISS SUPERMODEL GLOBE, INDIA 2022, SEASON 3
ReplyDeleteMISS #SUPERMODEL #GLOBAL, INDIA 2022, SEASON 3 is the ideal opportunity for you to boost your self-esteem and accomplish your objectives. Join us in promoting cancer awareness among women in India and changing lives.
SEMI FINALE is scheduled on 12th MARCH 2023 in DELHI
However slots are filling up quickly, so don't wait to register.
https://www.supermodelglobe.com/register.html
SUPERMODEL GLOBE wishes #Heartiest Congratulation to the GUWAHATI State finalist Miss Neha Mili. You have the chance of a lifetime to take advantage of it with her
There is not much time left!
Don't wait until it's too late to take advantage of this opportunity.
One Za'abeel the world's best living, working, and leisure experiences in the heart of Dubai.
#One-Zaabeel