Spring 5 , basic Authentication and base64 password Encoder

user_2560685 0
Viewed 2374

I use spring 5 in all my projects. I want to add a basic auth with only one secret/login for one endpoint. (just for remember, a basic auth is based on request who use to authentify an header "Authorization : Basic ${encryptedInBase64('login:password')}")

My issue is, the basic auth initialized by spring-web encrypt the login:secret using a base64 encoder

BUT

spring security don't propose anymore base64 password encoder anymore "because the encryption level is too low"

A quick fix would be

  1. use the deprecated Md4PasswordEncoder, who encode/decode in base64
  2. implement my own "MtBase64PasswordEncoder" class, who do the same.

But neither of them seems clean.

So my question is : what is the clean way to do a connection with a basic auth between two spring 5 projects? How does spring expect us to do basic auth?

spring-security spring-mvc basic-authentication spring java
2 Answers

From the "Basic Auth" RFC (https://www.rfc-editor.org/rfc/rfc7617.txt):

This document defines the "Basic" Hypertext Transfer Protocol (HTTP) authentication scheme, which transmits credentials as user-id/ password pairs, encoded using Base64.

Encoding the user/password pair with Base64 is in the standard. You should therefore not use anything else, except move away from Basic Auth.

Base64 is also not "weak", because it is not an encryption, just an encoding. It is not better than plain text. It still needs to be encoded, because both username and password could contain characters that are not allowed in HTTP headers.

EricSchaefer_89760

The Spring password encoder API is meant to be used to encode a password before storing in a database e.g. It has nothing to do with Basic Authentication!

Basic Authentication has to use Base64 by definition, see RFC 7617. And it uses Base64 encoding for username and password.

The Spring Security PasswordEncoder is used to create a kind of hash to be stored securely and to be used later to check a password. The result must not be able to be unencoded to get the original password! Therefore a PasswordEncoder using Base64 is a bad idea as you can always reverse decode the content.

From my point the name PasswordEncoder is misleading and the Spring team should have named it maybe PasswordHashFunction or similar to clarify it’s one way functionality.

If you are using current Spring Security versions be aware of the two PasswordEncoder interfaces:

  • org.springframework.security.authentication.encoding.PasswordEncoder is deprecated
  • better use org.springframework.security.crypto.password.PasswordEncoder.
user_128900
Related