spring-projects / spring-projects/spring-security
Allow setting of shared secret (pepper) for password storage
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Expected Behavior
When using the Password4j password encoders, I can optionally provide a shared secret/pepper that is then used as the pepper in the Password4j library (and therefore is not part of the stored hash value).
Current Behavior
Currently, it is not possible to use a shared secret pepper with Spring Security's default password encoders. To use a pepper, one must write a custom password encoder.
Context
We are building a system where we want a shared secret/pepper, as described in the OWASP Password Storage Cheat Sheet. Since logins are distributed across multiple devices, including offline devices, we would like to provide a shared secret/pepper to the application through another secure means so it can be used in the password storage process.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing Spring Security's default Password4j password encoders and how they receive encoder configuration. Done means callers can optionally supply a shared secret or pepper that Password4j uses without including it in the stored hash, with coverage for the supported encoders.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100