liveBook · Manning

Hash prefix

As explained in Spring Security in Action, Second Edition

A hash prefix is an identifier prepended to a stored password hash to indicate which password encoder produced it.

A hash prefix identifies the password encoder that should verify a stored password hash. DelegatingPasswordEncoder reads the prefix and routes matching to the registered implementation. section 4.1.4

Use the prefix as part of the stored hash format:

  • Wrap the encoder key in mandatory curly braces, such as {bcrypt} or {noop}. section 4.1.4
  • Map each key to a PasswordEncoder, such as BCryptPasswordEncoder, SCryptPasswordEncoder, or NoOpPasswordEncoder. section 4.1.4
  • Treat an unprefixed hash with the default encoder selected when DelegatingPasswordEncoder is constructed; the shown configuration defaults to bcrypt. section 4.1.4

Stored hash examples

For {noop}12345, delegation selects NoOpPasswordEncoder. A hash beginning with {bcrypt}, such as {bcrypt}$2a$10$xn3LI/AjqicFYZFruSwve.681477XaVNaUQbr1gioaWPn4t1KsnmG, selects BCryptPasswordEncoder. section 4.1.4

How Spring Security in Action, Second Edition covers it

How deep it goes
Defines prefix syntax and fallback behavior, then demonstrates encoder mappings without descending into hashing internals.
Examples
Uses {noop}12345, a concrete bcrypt hash, and mappings for noop, bcrypt, and scrypt encoders.
What you can do after
Operate/configure DelegatingPasswordEncoder with prefixed hashes and select a default encoder for unprefixed values.
How it connects
Connects DelegatingPasswordEncoder with PasswordEncoder, BCryptPasswordEncoder, SCryptPasswordEncoder, and NoOpPasswordEncoder.
Cover of Spring Security in Action, Second Edition
liveBookmanning.com
Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.