密碼的加密和匹配

1 爲何須要對密碼進行加密和匹配

　　用戶輸入的密碼原則上即便是超級管理員也是不能知道密碼的，因此在用戶進行註冊時不是直接將用戶的密碼存儲到數據庫中，而是將用戶的密碼通過加密後存放到數據庫的；當用戶註冊完後進行登陸時，先根據用戶名到數據庫中去查找數據，若是有數據就將用戶的信息查詢出來，此時查詢出來的用戶密碼是通過加密的，可是用戶登陸時輸入的密碼又是沒有加密的，就須要對用戶的數據的密碼進行註冊時密碼加密規則進行加密後再跟從數據庫中查詢到的用戶密碼進行匹配。

 

2 springSecurity提供了一個接口來實現密碼的加密和匹配

//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by Fernflower decompiler)
//

package org.springframework.security.crypto.password;

public interface PasswordEncoder {
    String encode(CharSequence var1);

    boolean matches(CharSequence var1, String var2);
}

接口源碼

　　技巧：咱們須要本身實現這個接口，並在加密方法和匹配方法中編寫一致的加密規則

 

3 如何實現本身的密碼加密和匹配類

　　利用SpringSecurity提供的Md5PasswordEncoder類來實現咱們的加密規則

　　3.1 編程步驟

　　　　前提：導入springSecurity的相關jar包【我使用的是springboot項目】

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>cn.xiangxu</groupId>
    <artifactId>spring_security_system</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <packaging>war</packaging>

    <name>spring_security_system</name>
    <description>Demo project for Spring Security</description>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>1.5.9.RELEASE</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <java.version>1.8</java.version>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <!--<dependency>-->
            <!--<groupId>org.springframework.boot</groupId>-->
            <!--<artifactId>spring-boot-starter-tomcat</artifactId>-->
            <!--<scope>provided</scope>-->
        <!--</dependency>-->

        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>


</project>

View Code

　　　　3.1.1 實現PasswordEncoder接口

　　　　3.1.2 利用Md5PasswordEncoder重寫密碼加密、匹配方法

package cn.xiangxu.spring_security_system.utils;

import org.springframework.security.authentication.encoding.Md5PasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Component;

/**
 * 密碼加密、匹配類
 */
@Component
public class MyPasswordEncoder implements PasswordEncoder {
    /** 密碼加密所需的參數，隨便寫 */
    private final static String SALT = "fury";

    /**
     * 密碼加密
     * @param rawPassword 須要進行加密的原始密碼
     * @return 原始密碼通過加密後的值
     */
    @Override
    public String encode(CharSequence rawPassword) {
        Md5PasswordEncoder md5PasswordEncoder = new Md5PasswordEncoder();
        return md5PasswordEncoder.encodePassword(rawPassword.toString(), SALT);
    }

    /**
     * 密碼匹配
     * @param rawPassword 原始密碼
     * @param encodedPassword 加密後的密碼
     * @return 原始密碼和加密後的密碼匹配就返回true，不然返回false
     */
    @Override
    public boolean matches(CharSequence rawPassword, String encodedPassword) {
        Md5PasswordEncoder md5PasswordEncoder = new Md5PasswordEncoder();
        return md5PasswordEncoder.isPasswordValid(encodedPassword, rawPassword.toString(), SALT);
    }
}

加密、匹配類

package cn.xiangxu.spring_security_system.utils;

import lombok.extern.slf4j.Slf4j;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.test.context.junit4.SpringRunner;

import static org.junit.Assert.*;

@RunWith(SpringRunner.class)
@SpringBootTest
@Slf4j
public class MyPasswordEncoderTest {

    @Autowired
    private MyPasswordEncoder myPasswordEncoder;

    @Test
    public void encode() throws Exception {
        System.out.println("hello boy");
        log.info("測試日誌輸出");
        String password = "123456";
        String result = myPasswordEncoder.encode(password);
        System.out.println("原始密碼爲：" + password);
        System.out.println("加密後的密碼爲：" + result);
    }

    @Test
    public void matches() throws Exception {
        String password01 = "123456";
        String encodePassword = myPasswordEncoder.encode(password01);
        Boolean result = myPasswordEncoder.matches(password01, encodePassword);
        System.out.println("密碼匹配結果爲：" + result);
    }

}

加密、匹配方法測試類