Replace our own PasswordHasher
with BCryptPasswordEncoder
in budgeteer-web-interface
#530
Labels
PasswordHasher
with BCryptPasswordEncoder
in budgeteer-web-interface
#530
The
budgeteer-web-interface
currently uses SHA-512 without any salt to hash passwords. This isn't optimal since it's possible to lookup the unhashed passwords using a rainbow table. As such we should strive to use a better method of hashing passwords, like theBCryptPasswordEncoder
provided by Spring Security.As part of this effort we also need to rehash passwords that are still hashed using the old hashing algorithm. This check should be done everytime a user logs in.
The text was updated successfully, but these errors were encountered: