I've got a bit of time between projects, so I've decided to brush up on Spring Security, as it has been a while since I've tried to follow updates.
The first thing I noticed is that when playing around, Spring 5 really doesn't want you to deal with plain text passwords. This is completely understandable; plain text passwords are BAD and cause bad things to happen in the real world. Unfortunately, if I'm just trying to play around with the security framework, this can make things a bit clunky. I've learned there are two ways to work around
1. Do simple inMemoryAuthentication after explicitly calling User.withDefaultPasswordEncoder() to allow plain text passwords while just playing around.
The first thing I noticed is that when playing around, Spring 5 really doesn't want you to deal with plain text passwords. This is completely understandable; plain text passwords are BAD and cause bad things to happen in the real world. Unfortunately, if I'm just trying to play around with the security framework, this can make things a bit clunky. I've learned there are two ways to work around
1. Do simple inMemoryAuthentication after explicitly calling User.withDefaultPasswordEncoder() to allow plain text passwords while just playing around.
2. Roll a simple/custom UserDetailsService for configure() to use that knows the password doesn't get encryption by prefixing "{noop}" to the password text. (Thanks to ever helpful mkyong for this.)
Comments
Post a Comment