1. Overview
Spring Boot CLI (Command Line Interface) is a Spring Boot tool for running and testing Spring Boot applications from a command prompt. This tool provides a very useful feature for encoding passwords. The main purpose of this tool is to avoid exposing plain text passwords and be able to generate and use encoded ones instead.
In this tutorial, we’ll dive into the Spring Security world to learn how to encode passwords with Spring Boot CLI.
2. Password Encoding
Password encoding is simply a way to represent the password in a binary format capable of being saved on a storage medium. We can either encode passwords using Spring Security, or we can delegate to Spring Boot CLI.
2.1. Spring Security PasswordEncoder
Spring Security provides the PasswordEncoder interface, which comes in a significant number of implementations, such as StandardPasswordEncoder and BCryptPasswordEncoder.
Furthermore, Spring Security recommends the use of BCryptPasswordEncoder, which is based on a powerful algorithm with a randomly generated salt. In previous versions of the framework, it was possible to use the MD5PasswordEncoder or SHAPasswordEncoder classes, but they are now deprecated due to the weakness of their algorithm.
In addition, these two classes forced the developer to pass the salt as a constructor parameter, while BCryptPasswordEncoder will internally generate a random salt. The string generated by BCryptPasswordEncoder will be 60 characters in size, and the base column should therefore accept a string of this size.
The StandardPasswordEncoder class, on the other hand, is based on an SHA-256 algorithm.
Obviously, the user passwords that will be created in third-party systems must be encoded in accordance with the type of encoding chosen in Spring Security for their authentication to be successful.
2.2. Spring Boot CLI Password Encoder
Spring Boot CLI comes with a bunch of commands, one of which is the encodepassword. This command allows encoding a password for use with Spring Security. Simply put, Spring Boot CLI encodepassword command can directly convert a raw password into an encrypted one using this simple syntax:
spring encodepassword [options] <password to encode>
It’s worth noting that starting from Spring Security 5.0, the default mechanism for password encoding is BCrypt.
3. Example
In order to clarify the use of the password encoding mechanism with Spring Boot CLI, we’ll use a basic authentication service to authenticate a user via username and password. For this example, we’ll simply use the spring security auto-configuration.
The idea is to avoid exposing plain text passwords and use encoded ones instead. Now Let’s see how to use the encodepassword command to encode passwords with Spring Boot CLI. We simply need to execute in a command prompt this command:
spring encodepassword baeldungPassword
The result of the above command is an encoded password with BCrypt, which is very hard to crack. For instance, the encoded password to use in the Spring Boot Security config looks like this:
{bcrypt}$2y$10$R8VIwFiQ7aUST17YqMaWJuxjkCYqk3jjPlSxyDLLzqCTOwFuJNq2a
Let’s now customize the default security configuration by modifying the property file. For instance, we can override the default username and password by adding our own.
Our encoded password goes into the spring.security.user.password property:
spring:
security:
user:
name: baeldung
password: '{bcrypt}$2y$10$R8VIwFiQ7aUST17YqMaWJuxjkCYqk3jjPlSxyDLLzqCTOwFuJNq2a'
4. Conclusion
In this article, we learned how to encode passwords with Spring Boot CLI. Also, we used Spring Security simple authentication to demonstrate how to use the encoded password. The main purpose is to avoid exposing plain text passwords and be able to generate encoded ones with ease.
As always, the complete code for the tutorial is available over on GitHub.
