spring-projects / spring-projects/spring-security
Support upgradeEncoding in Password4j-based PasswordEncoder implementations
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
The Password4j-based password encoders currently return false for the upgradeEncodingNonNull method, which means they don't support automatic password encoding upgrades when configuration parameters change. This should be enhanced to properly detect when a password needs to be re-encoded with updated parameters.
Affected Classes
Password4jPasswordEncoder (base class)
Argon2Password4jPasswordEncoder
BcryptPassword4jPasswordEncoder
ScryptPassword4jPasswordEncoder
Pbkdf2Password4jPasswordEncoder
BalloonHashingPassword4jPasswordEncoder
Related #17825
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with Password4jPasswordEncoder and compare upgradeEncodingNonNull across Argon2Password4jPasswordEncoder, BcryptPassword4jPasswordEncoder, ScryptPassword4jPasswordEncoder, Pbkdf2Password4jPasswordEncoder, and BalloonHashingPassword4jPasswordEncoder. Review related issue #17825 and existing encoder tests if available; done means changed configuration parameters are detected so passwords can be re-encoded.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100