Spring Security Users, Passwords and PasswordEncoder

//PasswordDemo.java
package com.javabrahman.security.passwords;

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.factory.PasswordEncoderFactories;
import org.springframework.security.crypto.password.PasswordEncoder;

public class PasswordDemo {

  public static void main(String[] args) {
    System.out.println("== BCryptPasswordEncoder");
    PasswordEncoder bcrypt = new BCryptPasswordEncoder();
    String first = bcrypt.encode("secret");
    String second = bcrypt.encode("secret");
    System.out.println("hash 1: " + first);
    System.out.println("hash 2: " + second);
    System.out.println("same hash twice?   " + first.equals(second));
    System.out.println("matches hash 1?    " + bcrypt.matches("secret", first));
    System.out.println("matches hash 2?    " + bcrypt.matches("secret", second));
    System.out.println("wrong password?    " + bcrypt.matches("Secret", first));
    System.out.println("parts of hash 1:   version " + first.substring(1, 3) + ", cost " + first.substring(4, 6)
        + ", salt " + first.substring(7, 29) + ", hash " + first.substring(29));

    System.out.println("== DelegatingPasswordEncoder");
    PasswordEncoder encoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();
    String stored = encoder.encode("secret");
    System.out.println("encode:            " + stored);
    System.out.println("matches {bcrypt}:  " + encoder.matches("secret", stored));
    System.out.println("matches {noop}:    " + encoder.matches("secret", "{noop}secret"));
    System.out.println("upgrade {noop}?    " + encoder.upgradeEncoding("{noop}secret"));
    System.out.println("upgrade {bcrypt}?  " + encoder.upgradeEncoding(stored));
    try {
      encoder.matches("secret", "secret");   // stored without an {id} prefix
    } catch (IllegalArgumentException e) {
      System.out.println("no prefix:         " + e.getMessage());
    }
  }
}

create table users (
  username varchar(50) not null primary key,
  password varchar(500) not null,
  enabled boolean not null
);

create table authorities (
  username varchar(50) not null references users(username),
  authority varchar(50) not null
);
create unique index ix_auth_username on authorities (username, authority);

//UserConfig.java
package com.javabrahman.security.passwords;

import javax.sql.DataSource;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.factory.PasswordEncoderFactories;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.JdbcUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

import static org.springframework.security.config.Customizer.withDefaults;

@Configuration
public class UserConfig {

  @Bean
  PasswordEncoder passwordEncoder() {
    return PasswordEncoderFactories.createDelegatingPasswordEncoder();
  }

  @Bean
  JdbcUserDetailsManager users(DataSource dataSource) {
    JdbcUserDetailsManager users = new JdbcUserDetailsManager(dataSource);
    users.setEnableUpdatePassword(true);   // let Spring Security re-hash outdated passwords at login
    return users;
  }

  @Bean
  SecurityFilterChain chain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/register", "/debug/passwords").permitAll()
            .anyRequest().authenticated())
        .httpBasic(withDefaults())
        .csrf(csrf -> csrf.disable())
        .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
    return http.build();
  }
}

//AccountController.java
package com.javabrahman.security.passwords;

import java.security.Principal;
import java.util.List;
import org.springframework.http.ResponseEntity;
import org.springframework.jdbc.core.simple.JdbcClient;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.UserDetailsManager;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class AccountController {
  private final UserDetailsManager users;
  private final PasswordEncoder encoder;
  private final JdbcClient jdbc;

  public AccountController(UserDetailsManager users, PasswordEncoder encoder, JdbcClient jdbc) {
    this.users = users;
    this.encoder = encoder;
    this.jdbc = jdbc;
  }

  @PostMapping("/register")
  public ResponseEntity<String> register(@RequestParam String username, @RequestParam String password) {
    if (users.userExists(username)) {
      return ResponseEntity.status(409).body("username taken");
    }
    users.createUser(User.withUsername(username).password(encoder.encode(password)).roles("USER").build());
    return ResponseEntity.status(201).body("registered " + username);
  }

  @GetMapping("/api/me")
  public String me(Principal principal) {
    return "logged in as " + principal.getName();
  }

  // For this demo only: shows what the database holds. Never expose password hashes in a real application.
  @GetMapping("/debug/passwords")
  public List<String> passwords() {
    return jdbc.sql("select username, password from users order by username")
        .query((rs, n) -> rs.getString(1) + " = " + rs.getString(2))
        .list();
  }
}

//UsersApp.java
package com.javabrahman.security.passwords;

import org.springframework.boot.CommandLineRunner;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.UserDetailsManager;

@SpringBootApplication
public class UsersApp {

  @Bean
  CommandLineRunner seed(UserDetailsManager users, PasswordEncoder encoder) {
    return args -> {
      users.createUser(User.withUsername("ann").password(encoder.encode("ann-pass")).roles("USER").build());
      // a user from an old system, whose password was stored in plain text
      users.createUser(User.withUsername("old").password("{noop}old-pass").roles("USER").build());
    };
  }

  public static void main(String[] args) {
    SpringApplication.run(UsersApp.class, args);
  }
}