Spring Security 5.x兼容多种密码加密方式

1 spring security PasswordEncoder

spring security 5不需要配置密码的加密方式，而是用户密码加前缀的方式表明加密方式，如：

• {MD5}88e2d8cd1e92fd5544c8621508cd706b代表使用的是MD5加密方式；
• {bcrypt}$2a$10$eZeGvVV2ZXr/vgiVFzqzS.JLV878ApBgRT9maPK1Wrg0ovsf4YuI6代表使用的是bcrypt加密方式。

spring security官方推荐使用更加安全的bcrypt加密方式。

这样可以在同一系统中支持多种加密方式，迁移用户比较省事。spring security 5支持的加密方式在PasswordEncoderFactories中定义：

public class PasswordEncoderFactories {



    public static PasswordEncoder createDelegatingPasswordEncoder() {



        String encodingId = "bcrypt";



        Map<String, PasswordEncoder> encoders = new HashMap();



        encoders.put(encodingId, new BCryptPasswordEncoder());



        encoders.put("ldap", new LdapShaPasswordEncoder());



        encoders.put("MD4", new Md4PasswordEncoder());



        encoders.put("MD5", new MessageDigestPasswordEncoder("MD5"));



        encoders.put("noop", NoOpPasswordEncoder.getInstance());



        encoders.put("pbkdf2", new Pbkdf2PasswordEncoder());



        encoders.put("scrypt", new SCryptPasswordEncoder());



        encoders.put("SHA-1", new MessageDigestPasswordEncoder("SHA-1"));



        encoders.put("SHA-256", new MessageDigestPasswordEncoder("SHA-256"));



        encoders.put("sha256", new StandardPasswordEncoder());



        return new DelegatingPasswordEncoder(encodingId, encoders);



    }



 



    private PasswordEncoderFactories() {



    }



}

2 测试

2.1 pom.xml

<?xml version="1.0" encoding="UTF-8"?>



<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"




    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">




    <modelVersion>4.0.0</modelVersion>




 



    <groupId>com.hfcsbc</groupId>




    <artifactId>security</artifactId>




    <version>0.0.1-SNAPSHOT</version>




    <packaging>jar</packaging>




 



    <name>security</name>




    <description>Demo project for Spring Boot</description>




 



    <parent>




        <groupId>org.springframework.boot</groupId>




        <artifactId>spring-boot-starter-parent</artifactId>




        <version>2.0.0.M7</version>




        <relativePath/> <!-- lookup parent from repository -->




    </parent>




 



    <properties>




        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>




        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>




        <java.version>1.8</java.version>




    </properties>




 



    <dependencies>




        <dependency>




            <groupId>org.springframework.boot</groupId>




            <artifactId>spring-boot-starter-security</artifactId>




        </dependency>




 



        <dependency>




            <groupId>org.springframework.boot</groupId>




            <artifactId>spring-boot-starter-test</artifactId>




            <scope>test</scope>




        </dependency>




        <dependency>




            <groupId>org.springframework.security</groupId>




            <artifactId>spring-security-test</artifactId>




            <scope>test</scope>




        </dependency>




        <dependency>




            <groupId>org.projectlombok</groupId>




            <artifactId>lombok</artifactId>




        </dependency>




    </dependencies>




 



    <build>




        <plugins>




            <plugin>




                <groupId>org.springframework.boot</groupId>




                <artifactId>spring-boot-maven-plugin</artifactId>




            </plugin>




        </plugins>




    </build>




 



    <repositories>




        <repository>




            <id>spring-snapshots</id>




            <name>Spring Snapshots</name>




            <url>https://repo.spring.io/snapshot</url>




            <snapshots>




                <enabled>true</enabled>




            </snapshots>




        </repository>




        <repository>




            <id>spring-milestones</id>




            <name>Spring Milestones</name>




            <url>https://repo.spring.io/milestone</url>




            <snapshots>




                <enabled>false</enabled>




            </snapshots>




        </repository>




    </repositories>




 



    <pluginRepositories>




        <pluginRepository>




            <id>spring-snapshots</id>




            <name>Spring Snapshots</name>




            <url>https://repo.spring.io/snapshot</url>




            <snapshots>




                <enabled>true</enabled>




            </snapshots>




        </pluginRepository>




        <pluginRepository>




            <id>spring-milestones</id>




            <name>Spring Milestones</name>




            <url>https://repo.spring.io/milestone</url>




            <snapshots>




                <enabled>false</enabled>




            </snapshots>




        </pluginRepository>




    </pluginRepositories>




</project>



 

2.2 测试

spring security 5.x默认使用bcrypt加密

@Slf4j




public class DomainUserDetailsService {



 



    public static void main(String[] args){



        PasswordEncoder passwordEncoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();



        String encode = passwordEncoder.encode("password");



        log.info("加密后的密码:" + encode);



        log.info("bcrypt密码对比:" + passwordEncoder.matches("password", encode));



 



        String md5Password = "{MD5}88e2d8cd1e92fd5544c8621508cd706b";//MD5加密前的密码为:password





        log.info("MD5密码对比:" + passwordEncoder.matches("password", encode));




    }



 



}

原文地址：https://blog.csdn.net/wiselyman/article/details/84915939