Spring Security
Hi is it possible to modify how spring security deals with passwords? Actually I would like my password to stay only in my database and never retrieve it just checking if for the account the password matches. But everywhere including in UserDetails I have to give access to the password to Spring.
26 Replies
⌛
This post has been reserved for your question.
Hey @Pseudow! Please useTIP: Narrow down your issue to simple and precise questions to maximize the chance that others will reply in here./close
or theClose Post
button above when your problem is solved. Please remember to follow the help guidelines. This post will be automatically closed after 300 minutes of inactivity.
you could write a custom authenticatio provider
autowire your database and run a function call on database
but how can I deal with the UsernamePasswordAuthenticationToken then? Even if I modify the authentification provider it will still have some internal objects that require this password field right?
Unknown User•16mo ago
Message Not Public
Sign In & Join Server To View
but I mean the password hash
not the password itself
Unknown User•16mo ago
Message Not Public
Sign In & Join Server To View
don't worry bro
I am already using Argon2 to protect my passwords
in my database
but It would be so much better not to have the password in my JVM somewhere in its memory
something like this
but again in UsernamePasswordAuthenticationToken I have to specify the password can I let it be null?
i dont remember try and see
okay
Unknown User•16mo ago
Message Not Public
Sign In & Join Server To View
because it feels so much weirder having a hashed password somewhere in my application I think its much safer if its only in the database
Unknown User•16mo ago
Message Not Public
Sign In & Join Server To View
I know but it just doesn't feel right. But ig Spring won't let me do that
Unknown User•16mo ago
Message Not Public
Sign In & Join Server To View
i mean you still getting password in jvm from the user
no getting around that unless oAuth or something
Unknown User•16mo ago
Message Not Public
Sign In & Join Server To View
yes I would like to do that but I just have to implement the AuthenticationProvider myself?
because even UsernamePasswordAuthenticationToken requires this field
just pass in null
okay ill try to do that
i am not a security expert
do not use in prod without testing
yes I was gonna test that anyway
but I am far away from prod
lol
💤
Post marked as dormant
This post has been inactive for over 300 minutes, thus, it has been archived.
If your question was not answered yet, feel free to re-open this post or create a new one.
In case your post is not getting any attention, you can try to use /help ping
.
Warning: abusing this will result in moderative actions taken against you.