利用Spring Security实现密码加密和验证

导入依赖

Spring Boot with Maven

<dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
</dependency>

Spring Boot without Maven

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-web</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-config</artifactId>
</dependency>

实现加密

先新建 BCryptPasswordEncoder 类的变量

可以将此加入IOC容器

val passwordEncoder = BCryptPasswordEncoder()

调用 encode() 方法实现密码的加密

val password = "123456"
val encode = passwordEncoder.encode(password)
println("encode===>${encode}")

每次调用 encode() 方法加密出来的密文都是不一样的, 结果如下

// 第一次
password===>123456
encode=====>$2a$10$dHHUQstE92nZUJTpw2rZPeRZkWRGhuWLWqI0skipNrihoPdBNHzfq
// 第二次
password===>123456
encode=====>$2a$10$SY/xpWp0qlHYxL9.v8oW0ullNGwrbCLRSJn7F0yRTS291R3y9a9Ay
// 第三次
password===>123456
encode=====>$2a$10$A2IM.lgX4Rc7GAaLJlZuKeekm5ib7rJ9ZLybzmsZULuVdXrWUFqXe

将三次生成的密文保存下来

// 由于'$'为kotlin特殊字符,所以要加上'\'转义
val encode1 = "\$2a\$10\$dHHUQstE92nZUJTpw2rZPeRZkWRGhuWLWqI0skipNrihoPdBNHzfq"
val encode2 = "\$2a\$10\$SY/xpWp0qlHYxL9.v8oW0ullNGwrbCLRSJn7F0yRTS291R3y9a9Ay"
val encode3 = "\$2a\$10\$A2IM.lgX4Rc7GAaLJlZuKeekm5ib7rJ9ZLybzmsZULuVdXrWUFqXe"

最后进行密码与密文的配对

定义正确和错误的密码

val rightPassword = "123456"
val wrongPassword1 = "ajdawjdoaj"
val wrongPassword2 = "1234566"
val wrongPassword3 = "1223456"

使用 matches() 方法进行比对

println(passwordEncoder.matches(rightPassword,encode1))
println(passwordEncoder.matches(rightPassword,encode2))
println(passwordEncoder.matches(rightPassword,encode3))

println(passwordEncoder.matches(wrongPassword1,encode1))
println(passwordEncoder.matches(wrongPassword1,encode2))
println(passwordEncoder.matches(wrongPassword1,encode3))
println(passwordEncoder.matches(wrongPassword2,encode1))
println(passwordEncoder.matches(wrongPassword3,encode2))

输出结果

rightPassword,encode1===>true
rightPassword,encode2===>true
rightPassword,encode3===>true
wrongPassword1,encode1===>false
wrongPassword1,encode2===>false
wrongPassword1,encode3===>false
wrongPassword2,encode1===>false
wrongPassword3,encode2===>false

结论

可以看到:

正确的密码,无论和第几次生成的密文匹配,都是正确的;

而错误的始终是错误的;

这就正确的实现了密码的加密;

并且同时也可以验证密码的正确与否;