Question

所以我可以在没有问题的情况下向Bcrypt注册用户并将哈希值存储在mysql数据库中但是当我尝试登录时，密码只是纯文本。我不确定我在这里做错了什么。我使用的是Spring Boot，登录Post并不明确，所以我不确定密码参数的编码在哪里。谢谢！

package blog.config;

import javax.sql.DataSource;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.web.csrf.CsrfTokenRepository;
import org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;


@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {


    @Autowired
DataSource datasource;



@Bean   
public BCryptPasswordEncoder passwordEncoder(){ 
       return new BCryptPasswordEncoder(); 
   } 



@Autowired
BCryptPasswordEncoder Bcrypt;

@Autowired
UserDetailsService userdetails;

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception{

    auth.jdbcAuthentication().dataSource(datasource).and().userDetailsService(userdetails).passwordEncoder(Bcrypt);


}





@Override
protected void configure(HttpSecurity http) throws Exception{


    http.csrf().csrfTokenRepository(csrfTokenRepository());

    http.authorizeRequests()
            .antMatchers("/admin/**", "/admin").authenticated()

            .and()
            .formLogin().loginPage("/admin/login").usernameParameter("username").passwordParameter("password").
            permitAll()
            .and()
            .csrf();
    http.logout().logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
            .logoutSuccessUrl("/").deleteCookies("JSESSIONID").clearAuthentication(true)
            .invalidateHttpSession(true);



}


private CsrfTokenRepository csrfTokenRepository()
{
    HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();
    repository.setSessionAttributeName("_csrf");
    return repository;
}
}

Spring Bcrypt身份验证

0 个答案: