4

This questions has been answered in this Stack Overflow question already, but it's not Grails-specific and is also kind of vague.

I set my Grails app up with Spring Security, but apparently didn't get the newest version, because it defaulted to SHA-256 instead of bcrypt. Now I have production data with passwords hashed in what seems to be a less-than-ideal method.

It's a piece of cake to enable bcrypt hashing:

Config.groovy > grails.plugins.springsecurity.password.algorithm = 'bcrypt'

but now I need the app to convert the old hashes into new ones. Fundamentally, I understand that when a user logs in, I should have the app check to see if the password is an SHA-256 hash, and if so, re-hash the entered password with bcrypt. After a while, they'll all be upgraded and that code can be removed.

What is the actual code for determining if a password hash is from SHA-256 or bcrypt, though?

EDIT

That is to say, what is the actual function that I call to get a hash? How do I bcrypt(incomingpassword) to see if it matches the existing password hash?

1 Answer 1

7

bcrypt passwords will start with "$2a$10$" and be 60 chars long. There is no pattern for SHA-256, but it will be 64 chars long.

10
  • Thanks, Burt. I still have the same problem, though; I have no idea how to instantiate and call an arbitrary password encoder at will. I have dug into Spring Security's internals, but it quickly gets beyond my ability to understand at this point. If I want to go user.hashedPassword == bcrypt(incomingPassword)... what do I actually type instead of "bcrypt"? Dec 20, 2013 at 19:42
  • 7
    I thought this was interesting and good to have documented, so I worked up an implementation and blog post here: burtbeckwith.com/blog/?p=2017 Dec 20, 2013 at 22:14
  • Hmm. Could not instantiate bean class [org.springframework.security.authentication.encoding.MessageDigestPasswordEncoder]: Constructor threw exception; nested exception is java.lang.IllegalArgumentException: No such algorithm [bcrypt] I'm running Grails 2.2.0 and the Spring Security plugin 2.0-RC2. Dec 27, 2013 at 19:26
  • Use the settings for SHA-256 or whatever the old algorithm is - the bcrypt encoder is explicitly configured. Once you're ready to switch to a single algorithm, remove all of this and configure bcrypt like in a new app Dec 27, 2013 at 19:32
  • 2
    You probably need grails.plugin.springsecurity.password.hash.iterations = 1 also, since the 1.2 plugin used 1 iteration and the 2.0 plugin defaults to 10,000 Dec 30, 2013 at 17:34

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.