Giters

svlada / springboot-security-jwt

Token-based authentication using Spring Boot and JWT.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Password encode

JingwenJessica opened this issue · comments

commented

Hello Valdimir,

Thanks for your blog and example on spring boot / jwt.

I notice that you use "$2a$10$bnC26zz//2cavYoSCrlHdecWF8tkGfPodlHcYwlACBBwJvcEf0p2G" as password instead of "test1234". Is this encoded code for "test1234"? Could you explain why do we need encoded code here? How could we get it?

Thanks,
Jessica

commented

A little late, but I hope this can help someone else.

Typically the back end of an authentication mechanism stores hashed passwords, in this case "$2a$10$bnC26zz//2cavYoSCrlHdecWF8tkGfPodlHcYwlACBBwJvcEf0p2G" is the hash of the password "test1243". It uses the BCrypt hashing function, and if you look at the PasswordEncoderConfig class it uses an instance of BCryptPasswordEncoder, for which the default strength = 10.

You can verify this by going to an online BCrypt encoder such as this one and use 10 for the number of rounds. Note that for BCrypt, each time, a different hash value of length 60 is generated.