Implementing hash+salt in Spring 3 security
pI understand the idea of hash+salt when I create new entry to dtb. If I
have some fixed string for the salt it might not be hard to implement it,
but how to do it, when I want to use for example user's birthday as a
salt? Saving that password to database is easy, but how to hash this
during login? I've googled this piece of code for my
codeapplicationContext-security.xml/code file, where they use
codeusername/code value for salt:/p precodelt;!-- authentication from
database --gt; lt;security:authentication-managergt;
lt;security:authentication-providergt; lt;security:jdbc-user-service
data-source-ref=dataSource users-by-username-query= select
username,password, enabled from users where
username=?authorities-by-username-query= select u.username, ur.authority
from users u, user_roles ur where u.user_id = ur.user_id and u.username =?
/gt; lt;security:password-encoder hash=sha-256gt; lt;security:salt-source
user-property=username /gt; lt;/security:password-encoder--gt;
lt;/security:authentication-providergt;
lt;/security:authentication-managergt; /code/pre pSo if I undrestand it
correctly, it means, that if I would like to use user's birthday as salt,
I would have to have it stored in my dtb, pull it out from dtb and then
use it as a salt? It doesn't make sence to me, because if I have in my
codeusers/code table columns codeusername/code, codepassword/code,
codebirthday/code, then the password can be hashed, but it is quite clear,
that the codebithday/code value will be used as salt. Is there something
I'm missing or does it really work so?/p
No comments:
Post a Comment