Class AbstractPasswordEncoder
java.lang.Object
org.springframework.security.crypto.password.AbstractPasswordEncoder
- All Implemented Interfaces:
PasswordEncoder
Abstract base class for password encoders
-
Constructor Summary
-
Method Summary
Modifier and TypeMethodDescriptionencode
(CharSequence rawPassword) Encode the raw password.protected abstract byte[]
encode
(CharSequence rawPassword, byte[] salt) protected byte[]
encodeAndConcatenate
(CharSequence rawPassword, byte[] salt) protected static boolean
matches
(byte[] expected, byte[] actual) Constant time comparison to prevent against timing attacks.boolean
matches
(CharSequence rawPassword, String encodedPassword) Verify the encoded password obtained from storage matches the submitted raw password after it too is encoded.Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
Methods inherited from interface org.springframework.security.crypto.password.PasswordEncoder
upgradeEncoding
-
Constructor Details
-
AbstractPasswordEncoder
protected AbstractPasswordEncoder()
-
-
Method Details
-
encode
Description copied from interface:PasswordEncoder
Encode the raw password. Generally, a good encoding algorithm applies a SHA-1 or greater hash combined with an 8-byte or greater randomly generated salt.- Specified by:
encode
in interfacePasswordEncoder
-
matches
Description copied from interface:PasswordEncoder
Verify the encoded password obtained from storage matches the submitted raw password after it too is encoded. Returns true if the passwords match, false if they do not. The stored password itself is never decoded.- Specified by:
matches
in interfacePasswordEncoder
- Parameters:
rawPassword
- the raw password to encode and matchencodedPassword
- the encoded password from storage to compare with- Returns:
- true if the raw password, after encoding, matches the encoded password from storage
-
encode
-
encodeAndConcatenate
-
matches
protected static boolean matches(byte[] expected, byte[] actual) Constant time comparison to prevent against timing attacks.
-