spring-projects / spring-projects/spring-security
SEC-2562: Modernize Password Storage
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Rob Winch (Migrated from SEC-2562) said:
Password storage has come a long ways and is a very important aspect of security. We should modernize how passwords are stored and managed.
A special thanks to John Steven for providing guidance on these recommendations.
Subtasks
- #4666 - Add DelegatingPasswordEncoder
- #2775 - Make adaptive one-way functions the default scheme (BCrypt)
- #2158 - Provide a PBKDF2 PasswordEncoder implementation
- #2776 - Deprecate all salted digest password encoding
- #2777 - Incorporate Password Storage Scheme spec into stored format
- #2778 - Support password storage upgrades
- #2779 - Formal audit of BCrypt implementation
- #2742 - Support PBKDF2 SHA256 for JDK8+
- #9833 Support phc Password Storage
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
This umbrella issue is decomposed into subtasks, with most already checked off. Review the remaining #2779 formal BCrypt audit and #9833 PHC password-storage work first; the issue itself names no files, tests, or single entry point. Done would require completing the remaining scoped subtasks and confirming the modernization plan is fully addressed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 15/100