BCryptPasswordEncoder

// $2a$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW
// \__/\/ \____________________/\_____________________________/
//  |   |          |                          |
//  |   |          |                          +-- 31 chars: the hash digest
//  |   |          +-- 22 chars: the random salt, generated per password
//  |   +-- cost (strength): 2^12 rounds
//  +-- algorithm version

// The same input hashes differently every time, and both hashes verify:
PasswordEncoder encoder = new BCryptPasswordEncoder(12);
String first  = encoder.encode("myPassword");
String second = encoder.encode("myPassword");

first.equals(second);                        // false, because the salts differ
encoder.matches("myPassword", first);        // true
encoder.matches("myPassword", second);       // true

// Store it in a column that is at least 60 characters wide. If you move to DelegatingPasswordEncoder
// later (see the migration section) a prefix like {bcrypt} is added, so VARCHAR(100) is a safer choice.

@Configuration
public class PasswordConfig {

    @Bean
    PasswordEncoder passwordEncoder(
            @Value("${security.password.bcrypt-strength:12}") int strength) {
        return new BCryptPasswordEncoder(strength);
    }
}

// application.yml
//   security:
//     password:
//       bcrypt-strength: 12
//
// application-test.yml
//   security:
//     password:
//       bcrypt-strength: 4      # the lowest value bcrypt accepts: fast tests, same code path

public final class BcryptBenchmark {

    public static void main(String[] args) {
        String sample = "SamplePassword123!";

        for (int strength = 10; strength <= 14; strength++) {
            BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(strength);
            encoder.encode(sample);                       // warm-up run, not measured

            int runs = 5;
            long start = System.nanoTime();
            for (int i = 0; i < runs; i++) {
                encoder.encode(sample);
            }
            long millis = (System.nanoTime() - start) / runs / 1_000_000;
            System.out.printf("strength %d: about %d ms per hash%n", strength, millis);
        }
    }
}

// Each +1 doubles the time. Typical output on a modern server core is somewhere around
// 60-80 ms at strength 10, 250-300 ms at 12, and over a second at 14. Your numbers will differ.

@Component
public class PasswordPolicy {

    private static final int MIN_LENGTH = 8;
    private static final int MAX_BYTES  = 72;   // bcrypt ignores anything beyond this

    public void check(String password) {
        if (password == null || password.length() < MIN_LENGTH) {
            throw new WeakPasswordException("Password must be at least " + MIN_LENGTH + " characters");
        }
        if (password.getBytes(StandardCharsets.UTF_8).length > MAX_BYTES) {
            throw new WeakPasswordException("Password must be at most " + MAX_BYTES + " bytes");
        }
        // Also consider rejecting known-breached passwords (for example via a local list).
    }
}

@Service
@RequiredArgsConstructor
public class UserService {

    private final UserRepository userRepo;
    private final PasswordResetTokenRepository tokenRepo;
    private final PasswordEncoder passwordEncoder;
    private final PasswordPolicy passwordPolicy;

    @Transactional
    public UserResponse register(RegisterRequest request) {
        passwordPolicy.check(request.password());

        User user = new User();
        user.setEmail(request.email().trim().toLowerCase(Locale.ROOT));   // normalise the email only
        user.setPassword(passwordEncoder.encode(request.password()));      // never trim the password
        user.setRoles(Set.of("USER"));

        try {
            return UserResponse.from(userRepo.saveAndFlush(user));
        } catch (DataIntegrityViolationException ex) {                    // unique constraint on email
            throw new DuplicateEmailException(user.getEmail());
        }
    }

    @Transactional
    public void changePassword(Long userId, ChangePasswordRequest request) {
        User user = userRepo.findById(userId).orElseThrow();

        if (!passwordEncoder.matches(request.currentPassword(), user.getPassword())) {
            throw new InvalidPasswordException("Current password is incorrect");
        }
        passwordPolicy.check(request.newPassword());

        user.setPassword(passwordEncoder.encode(request.newPassword()));   // managed entity, saved on commit
        // Also revoke this user's other sessions and refresh tokens here.
    }

    @Transactional
    public void resetPassword(String rawToken, String newPassword) {
        passwordPolicy.check(newPassword);

        // Only a SHA-256 of the token is stored, so a database leak does not expose usable tokens.
        PasswordResetToken token = tokenRepo.findByTokenHash(TokenHasher.sha256Hex(rawToken))
            .filter(t -> t.getExpiresAt().isAfter(Instant.now()))
            .orElseThrow(() -> new InvalidTokenException("Reset token invalid or expired"));

        token.getUser().setPassword(passwordEncoder.encode(newPassword));
        tokenRepo.delete(token);   // single use
    }
}

@Configuration
public class PasswordConfig {

    // Used while migrating from legacy unsalted hashes. Remove the legacy part once every row is upgraded.
    @Bean
    @SuppressWarnings("deprecation")
    PasswordEncoder passwordEncoder(
            @Value("${security.password.bcrypt-strength:12}") int strength) {

        Map<String, PasswordEncoder> encoders =
            Map.of("bcrypt", new BCryptPasswordEncoder(strength));

        DelegatingPasswordEncoder delegating = new DelegatingPasswordEncoder("bcrypt", encoders);

        // Stored values WITHOUT an {id} prefix are verified with this encoder. Use whatever produced
        // your old hashes. If your existing rows are already plain bcrypt ($2a$...), use a
        // BCryptPasswordEncoder here instead and they will upgrade to the prefixed format.
        delegating.setDefaultPasswordEncoderForMatches(new MessageDigestPasswordEncoder("MD5"));

        return delegating;
    }
}

@Service
@RequiredArgsConstructor
@Slf4j
public class AppUserDetailsService implements UserDetailsService, UserDetailsPasswordService {

    private final UserRepository userRepo;

    @Override
    @Transactional(readOnly = true)
    public UserDetails loadUserByUsername(String email) {
        return userRepo.findByEmail(email)
            .map(AuthenticatedUser::from)
            .orElseThrow(() -> new UsernameNotFoundException("User not found"));
        // DaoAuthenticationProvider turns this into a generic "bad credentials" for the client.
    }

    // Called after a successful login when the encoder says the stored hash is outdated.
    @Override
    @Transactional
    public UserDetails updatePassword(UserDetails details, String newEncodedPassword) {
        User user = userRepo.findByEmail(details.getUsername()).orElseThrow();
        user.setPassword(newEncodedPassword);   // saved on commit
        log.info("Upgraded password hash for user id {}", user.getId());   // never log the hash itself
        return AuthenticatedUser.from(user);
    }
}

// src/test/resources/application-test.yml
//   security:
//     password:
//       bcrypt-strength: 4

@SpringBootTest
@ActiveProfiles("test")
class UserServiceTest {

    private static final String PASSWORD = "TestPassword123!";

    @Autowired private UserService userService;
    @Autowired private UserRepository userRepo;
    @Autowired private PasswordEncoder passwordEncoder;   // the real bean, at strength 4

    private User user;

    @BeforeEach
    void setUp() {
        userRepo.deleteAll();
        user = new User();
        user.setEmail("test@example.com");
        user.setPassword(passwordEncoder.encode(PASSWORD));
        user.setRoles(Set.of("USER"));
        user.setEnabled(true);
        user = userRepo.save(user);
    }

    @Test
    void register_storesAHashNotThePassword() {
        userService.register(new RegisterRequest("new@example.com", PASSWORD));

        String stored = userRepo.findByEmail("new@example.com").orElseThrow().getPassword();
        assertThat(stored).isNotEqualTo(PASSWORD).startsWith("$2");
        assertThat(passwordEncoder.matches(PASSWORD, stored)).isTrue();
    }

    @Test
    void changePassword_replacesTheHashAndInvalidatesTheOldPassword() {
        String oldHash = user.getPassword();

        userService.changePassword(user.getId(), new ChangePasswordRequest(PASSWORD, "NewPassword456!"));

        String newHash = userRepo.findById(user.getId()).orElseThrow().getPassword();
        assertThat(newHash).isNotEqualTo(oldHash);
        assertThat(passwordEncoder.matches("NewPassword456!", newHash)).isTrue();
        assertThat(passwordEncoder.matches(PASSWORD, newHash)).isFalse();
    }

    @Test
    void changePassword_rejectsAWrongCurrentPassword() {
        assertThatThrownBy(() -> userService.changePassword(
                user.getId(), new ChangePasswordRequest("WrongPassword", "NewPassword456!")))
            .isInstanceOf(InvalidPasswordException.class);
    }

    @Test
    void register_rejectsPasswordsOverTheBcryptLimit() {
        String tooLong = "a".repeat(73);
        assertThatThrownBy(() -> userService.register(new RegisterRequest("x@example.com", tooLong)))
            .isInstanceOf(WeakPasswordException.class);
    }
}

// Plain unit test for the upgrade mechanism your login flow relies on (no Spring context needed):
class BcryptUpgradeTest {

    @Test
    void lowerCostHashesVerifyButAreFlaggedForUpgrade() {
        BCryptPasswordEncoder current = new BCryptPasswordEncoder(6);
        String oldHash = new BCryptPasswordEncoder(4).encode("pw");

        assertThat(current.matches("pw", oldHash)).isTrue();
        assertThat(current.upgradeEncoding(oldHash)).isTrue();
        assertThat(current.upgradeEncoding(current.encode("pw"))).isFalse();
    }
}

// Alternative: Argon2id. Needs org.bouncycastle:bcpkix-jdk18on on the classpath.
@Bean
PasswordEncoder argon2PasswordEncoder() {
    return Argon2PasswordEncoder.defaultsForSpringSecurity_v5_8();
}

// Best of both: a delegating encoder that writes Argon2 and still verifies existing bcrypt hashes.
@Bean
PasswordEncoder migratingEncoder() {
    Map<String, PasswordEncoder> encoders = Map.of(
        "argon2", Argon2PasswordEncoder.defaultsForSpringSecurity_v5_8(),
        "bcrypt", new BCryptPasswordEncoder(12));

    DelegatingPasswordEncoder delegating = new DelegatingPasswordEncoder("argon2", encoders);
    delegating.setDefaultPasswordEncoderForMatches(new BCryptPasswordEncoder(12));   // unprefixed $2a$ rows
    return delegating;
}