如何在我的 spring 启动应用程序中使用 Bcrypt 来保护密码？

Question

我的用户名和密码来自 angular 到 spring 引导，它存储在 mysql 中。我有简单的模型、存储库、服务和控制器包。我的模型是注册，它有名称用户名和密码，登录时，用户名和密码是从注册中获取的 table

我的注册模型Class


package com.example.angular.model;

import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;
import javax.persistence.Table;


@Entity
@Table(name="registration")
public class Registration {

    @Id
    @GeneratedValue(strategy= GenerationType.IDENTITY)
    private int id;

    private String name;
    private String username;
    private String password;
    public int getId() {
        return id;
    }
    public String getName() {
        return name;
    }
    public String getUsername() {
        return username;
    }
    public String getPassword() {
        return password;
    }
    public void setId(int id) {
        this.id = id;
    }
    public void setName(String name) {
        this.name = name;
    }
    public void setUsername(String username) {
        this.username = username;
    }
    public void setPassword(String password) {
        this.password = password;
    }
    public Registration(String name, String username, String password) {
        super();
        this.name = name;
        this.username = username;
        this.password = password;
    }
    public Registration() {
        super();
        // TODO Auto-generated constructor stub
    }
    @Override
    public String toString() {
        return "Registration [id=" + id + ", name=" + name + ", username=" + username + ", password=" + password + "]";
    }



}

我的注册控制器


import java.util.List;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.CrossOrigin;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import com.example.angular.model.Registration;
import com.example.angular.service.RegistrationService;

@RestController
@CrossOrigin(origins="*", allowedHeaders = "*")
@RequestMapping("/register")
public class RegistrationController {

    @Autowired
    private RegistrationService res;

    @PostMapping("/registeruser")
    public ResponseEntity<Registration> registeruser(@RequestBody  Registration reg)
    {


        Registration resk= res.registeruser(reg);

        return new ResponseEntity<Registration>(resk,HttpStatus.OK);


    }


    @PostMapping("/login")
    public ResponseEntity<Registration> loginuser(@RequestBody  Registration reg)
    {


        List<Registration> regList = res.getusername(reg.getUsername(), reg.getPassword());



            System.out.println("Logged in! ");
        //return new ResponseEntity<Registration>(reg.getUsername(), HttpStatus.OK);

    return null;


    }

}

我必须在包中添加任何配置文件还是必须在 angular 中使用 bcrypt？ Youtube 视频令人困惑，请帮助

Answer 1

我想你想要 Spring 安全。在这种情况下，您应该使用 BCryptPasswordEncoder。只需创建用于加密的 Bean。

    private static final String ADMIN = "ADMIN";
    private static final String USER = "USER";

    @Autowired
    private UserDetailService userDetailService;

    @Autowired
    private DataSource dataSource;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService).dataSource(dataSource)
                .passwordEncoder(passwordEncoder());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable().authorizeRequests()
                .antMatchers("/admin").hasRole(ADMIN)
                .antMatchers("/user").hasAnyRole(ADMIN, USER)
                .antMatchers("/", "/register-user").permitAll()
                .and().formLogin();
    }

    @Bean
    public BCryptPasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

如果你只是想用BCrypt加密密码。你可以这样使用

String password = "password";
BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
String hashedPassword = passwordEncoder.encode(password);

如何在我的 spring 启动应用程序中使用 Bcrypt 来保护密码？

How do I use Bcrypt in my spring boot application to secure passwords?

spring

spring-boot

bcrypt