Getting same hashed value while using BCryptPasswordEncoder

spring-security bcrypt
mms picture mms · Nov 8, 2014 · Viewed 19.5k times · Source

I am using spring security using BCryptPasswordEncoder. Now for change password what I need to do is to compare Existing Password provided by user with DB value.

But since salt is generated dynamically by BCryptPasswordEncoder, every time I get different hashed value from below method and not necessarily it would match with my DB value. 

public static String encodePassword(String password) {
    BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
    String hashedPassword = passwordEncoder.encode(password);
    return hashedPassword;
}

What's the remedy for this problem? can I identify salt used for my DB field and use the same salt in above method ?

Answer

Shaun the Sheep picture Shaun the Sheep · Nov 8, 2014

Use the matches method on the PasswordEncoder interface to check whether the password is valid, rather than encoding it again and comparing with the existing hash.

BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
String existingPassword = ... // Password entered by user
String dbPassword       = ... // Load hashed DB password

if (passwordEncoder.matches(existingPassword, dbPassword)) {
    // Encode new password and store it
} else {
    // Report error 
}

Related questions

Why BCryptPasswordEncoder from Spring generate different outputs for same input?

I am using BCryptPasswordEncoder with Spring security. My expectation was that for the same input I will always get the same output. But for the same input I get different output. You could test it with the code snippet below: …

Read More
Configuring Spring Boot Security to use BCrypt password encoding in Grails 3.0

In Grails 3.0, how do you specify that Spring Boot Security should use BCrypt for password encoding? The following lines should provide a sense of what I think needs to be done (but I'm mostly just guessing): import org.springframework.security.…

Read More
How to fix Hibernate LazyInitializationException: failed to lazily initialize a collection of roles, could not initialize proxy - no Session

In the custom AuthenticationProvider from my spring project, I am trying read the list of authorities of the logged user, but I am facing the following error: org.hibernate.LazyInitializationException: failed to lazily initialize a collection of role: com.horariolivre.…

Read More