How deeply does Spring Security in Action, Second Edition cover BCryptPasswordEncoder?

Defines the bcrypt role and constructors, but defers the hashing algorithm's internal operation.

BCryptPasswordEncoder

As explained in Spring Security in Action, Second Edition

BCryptPasswordEncoder is a Spring Security PasswordEncoder implementation that encodes passwords with the bcrypt password-hashing function.

BCryptPasswordEncoder is a Spring Security PasswordEncoder implementation that encodes passwords with the bcrypt strong hashing function. Use it when an application needs a password encoder rather than cleartext storage or weaker legacy hashing. section 4.1.3

Create the encoder with the constructor that matches the configuration needed:

Use new BCryptPasswordEncoder() for the default configuration. section 4.1.3
Use new BCryptPasswordEncoder(4) to provide a strength parameter. section 4.1.3
Use new BCryptPasswordEncoder(4, s) when supplying both strength and a SecureRandom instance. section 4.1.3

Instantiate the encoder

PasswordEncoder p = new BCryptPasswordEncoder(); PasswordEncoder p = new BCryptPasswordEncoder(4); SecureRandom s = SecureRandom.getInstanceStrong(); PasswordEncoder p = new BCryptPasswordEncoder(4, s); section 4.1.3

BCryptPasswordEncoder can also serve as the bcrypt delegate inside DelegatingPasswordEncoder. A {bcrypt} prefix selects it for matching, while the delegating encoder can retain other implementations for differently prefixed hashes. section 4.1.4

How Spring Security in Action, Second Edition covers it

Cover of Spring Security in Action, Second Edition

liveBook manning.com

Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

DelegatingPasswordEncoderused by · DelegatingPasswordEncoder is a Spring Security PasswordEncoder implementation that selects another password encoder according to an identifier in the stored password representation.
bcryptuses · bcrypt is an adaptive password-hashing algorithm based on the Blowfish key schedule with a configurable work factor that makes password guessing computationally expensive.
PasswordEncoderkind of · PasswordEncoder is a Spring Security interface and strategy for encoding passwords and verifying supplied passwords against stored encoded representations.
SCryptPasswordEncoderalternative to · SCryptPasswordEncoder is a Spring Security PasswordEncoder implementation that encodes passwords with the scrypt password-hashing function.
Pbkdf2PasswordEncoderalternative to · Pbkdf2PasswordEncoder is a Spring Security PasswordEncoder implementation that derives password representations using PBKDF2.

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.