在前一节使用数据库进行用户认证(form login using database)里，我们学习了如何把“登录帐号、密码”存储在db中，但是密码都是明文存储的，显然不太讲究。这一节将学习如何使用spring security3新加入的bcrypt算法，将登录加密存储到db中，并正常通过验证。
一、Bcrypt算法
1 int t = 0;
2 String password = "123456";
3 System.out.println(password + " -> ");
4 for (t = 1; t <= 10; t++) {
5 BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
6 String hashedPassword = passwordEncoder.encode(password);
7 System.out.println(hashedPassword);
8 }
9
10 password = "MIKE123";
11 System.out.println(password + " -> ");
12 for (t = 1; t <= 10; t++) {
13 BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
14 String hashedPassword = passwordEncoder.encode(password);
15 System.out.println(hashedPassword);
16 }
View Code
输出如下：
123456 ->
$2a$10$.Cjkvbgr2JzGkag9IdbT.Oc/sbY7wVqLgAHws7HCxqcI7eczKtCLq
$2a$10$OCOuRV0Wy7ncCND4LcKfMunVEWOzMOyyU95u5TkTRmJqYbsJNecEK
$2a$10$TXttsDZUaeEb2zX6wiwN0eqREKFoCDyh81Kfa6BgAcZ2hyqPNC0Ra
$2a$10$FfLx/gxq.FyeOBb0nbaVeusLhQjASSdY7w45i1ACl/rcYQMmhaXV2
$2a$10$JdPXAxmuz.WTP5gxYiYseeKRSM/HTFzJJdACcDQ4MdhaaLmC0SjI.
$2a$10$yVEWf2MrwjCyi51rUKqQle/MZb7vwcOf6Gwp.hDT2ZUchlyAtJ4pO
$2a$10$FfJg2ATit7btKfJovL6zmug//8rzToQn7FO.fxOzo1KtNNfhWKuca
$2a$10$pOLMkd13n7i3DtVijLEqze1zeURpjtVz5rAx1qOAPqCQvjGG/d6D.
$2a$10$fQ32i8JsjjmqVRpiEsgT3ekTKtrfXn.JNl69beWEx0.YgdX.SEx5e
$2a$10$78brJFSdftip0XXYx4rS6ewdu4SiSsMIBY9oNcLhAZwg3GysRGk2m
MIKE123 ->
$2a$10$U6KVh1NGxAIGYiM4YVgn6OAQt6ayAoLkh2lODv16rSpkS1iqfbR2C
$2a$10$t0FlEOBLEB8VwWJVoZRrweIRV0XyoBgm29c0SMqfqRK3ZBuvhgYbS
$2a$10$QpW6nHnWNhbTTjLq/NbzBu2Unp8ijwyPeUx2N2eMFWReFezosZ5fi
$2a$10$LtPzoQU0IluAgvP3/WhWquUv2AcDRh2ENhAeWDquiN/spitZYe/7q
$2a$10$Qcx7vUudzF7qzTjz.QpLKOby0tXQ4j.uqkInS1n4/6oD2r2eL0rZW
$2a$10$yZw7cdq1y9sjX8nZhYynseWjQ4jeVv76fPmBl.sg2xPvb8cyXD8Sq
$2a$10$kTmT6BQQE5LyRZ00Qas77.F5kxK0GxsW402ExosQswxmG.eBdgIZW
$2a$10$SRfHDNM.m3qX5y1O7V/cp.hQqgaXnKzfxBGRhLkAF39bufejuOieu
$2a$10$Sw5w2kTImJ5Y8UNlE/5/9OLaUgYxhCXU3P3gFBdEbs9PL8pCl60Q2
$2a$10$0mN8kNAl9GNr0c4K1Nr0b.MIcBW0QcPHB/f20hgeBuRfwvgZXT6hG
从以上输出结果发现bcrypt算法与md5/sha算法有一个很大的区别，每次生成的hash值都是不同的，这样暴力猜解起来或许要更困难一些。同时大家可能也发现了，加密后的字符长度比较长，有60位，所以用户表中密码字段的长度，如果打算采用bcrypt加密存储，字段长度不得低于60.
二、spring-security.xml
1 <beans:beans xmlns="http://www.springframework.org/schema/security"
2 xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3 xsi:schemaLocation="http://www.springframework.org/schema/beans
4 http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
5 http://www.springframework.org/schema/security
6 http://www.springframework.org/schema/security/spring-security-3.2.xsd">
7
8 <http auto-config="true" use-expressions="true">
9 <intercept-url pattern="/admin**" access="hasRole('ADMIN')" />
10 <!-- access denied page -->
11 <access-denied-handler error-page="/403" />
12 <form-login login-page="/login" default-target-url="/welcome"
13 authentication-failure-url="/login?error" username-parameter="username"
14 password-parameter="password" />
15 <logout logout-success-url="/login?logout" />
16 <!-- enable csrf protection -->
17 <csrf />
18 </http>
19
20 <!-- Select users and user_roles from database -->
21 <authentication-manager>
22 <authentication-provider>
23 <password-encoder ref="encoder" />
24 <jdbc-user-service data-source-ref="dataSource"
25 users-by-username-query="select d_username username,d_password password, d_enabled enabled from t_users where d_username=?"
26 authorities-by-username-query="select d_username username, d_role role from t_user_roles where d_username=? " />
27 </authentication-provider>
28 </authentication-manager>
29
30 <beans:bean id="encoder"
31 class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder">
32 <beans:constructor-arg name="strength" value="9" />
33 </beans:bean>
34
35 </beans:beans>
View Code
对比上一节的内容，只是增加23行、30-33行
最后要做的事情，就是把db中原来明文的密码值，改成经过bcrypt加密后的字符串即可。
tips:如果你仍然喜欢用传统的sha算法来处理密码，只要把23行改成 <password-encoder hash="sha" /> 就可以了
参考文章：Spring Security password hashing example