Spring Security BASIC auth - matching password hash

Question

When doing BASIC authentication with Spring Security I want to match password hash and not password itself. For the sake of storing hash and not the password server-side.

I have the following code:

@EnableWebSecurity
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    AppConfig appConfig;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
            http.authorizeRequests()
                    .antMatchers("/v2/**")
                    .hasAuthority(MY_AUTHORITY).anyRequest().authenticated()
                    .and()
                    .httpBasic();
    }

    @Autowired
    public void configureSecurityManager(AuthenticationManagerBuilder authManagerBuilder) throws Exception {
            new InMemoryUserDetailsManagerConfigurer<AuthenticationManagerBuilder>()
                    .withUser(appConfig.getCredentials().getUserName())
                    .password(appConfig.getCredentials().getPassword())
                    .authorities(MY_AUTHORITY)
                    .and()
                    .configure(authManagerBuilder);
    }
}

I've found some examples with BCrypt, however they're dealing with hashing the password and not incorporating hash comparison into BASIC auth scheme.

Or am I getting this wrong all the way and client should send hash and not the password to the server?

score 2 · Accepted Answer · answered May 07 '18 at 08:01

2

Here you have an example: http://www.devglan.com/spring-security/spring-boot-security-password-encoding-bcrypt-encoder

Once the password encoder is defined, while comparing password coming from the request with the DB password, spring will by default consider password in the DB is bcrypt encoded.

Also I recommend you the following link: https://security.stackexchange.com/questions/64631/is-it-safe-to-send-clear-usernames-passwords-on-a-https-connection-to-authentica

answered May 07 '18 at 08:01

Ignasi

5,887
7
45
81

I'm concerned not with sending, but with storing the password from BASIC auth. – Cortlendt May 07 '18 at 08:17
I'm not sure to understand you, when you specify a `PasswordEncoder` you are specifying how you want to store your passwords. So using a `BCryptPasswordEncoder` your passwords will be hashed and then saved. – Ignasi May 07 '18 at 08:46
1

Just added .passwordEncoder(new BCryptPasswordEncoder()) to configureSecurityManager(...) method and it works. – Cortlendt May 07 '18 at 09:02

Spring Security BASIC auth - matching password hash

1 Answers1