0

Im using Spring with Hibernate to interact with my database. I'm using JPA/Hibernate contraints to validate the input. But this doesn't seem to work for the passwords and I think it's because the setPassword() method of the User class automatically hashes the password. Here's some code:

class User {

    @Size(min = 12, max = 100)
    private String password;

    public User(..., String password) {
        this.passwordSeed = this.passwordSeed = DigestUtils.sha256Hex(random.generateSeed(32));
        this.password = DigestUtils.sha256Hex(password + this.passwordSeed);
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        if (passwordSeed == null) {
            this.passwordSeed = DigestUtils.sha256Hex(random.generateSeed(32));
        }
        this.password = DigestUtils.sha256Hex(password + this.passwordSeed);
    }
}

Note that I've trimmed the code a lot to be able to focus on the essential part. The ... in the constructor is my way of saying it has many more arguments to set other properties like firstName, etc.

So the problem is that the @Size constraint doesn't throw an exception when the user enters for example a one letter password. @Size does work for the firstName for example.

I've tried adding the constraint to the method variable, but that doesn't work either. Like this:

class User {


    private String password;

    public User(..., @Size(min = 12, max = 100) String password) {
        this.passwordSeed = this.passwordSeed = DigestUtils.sha256Hex(random.generateSeed(32));
        this.password = DigestUtils.sha256Hex(password + this.passwordSeed);
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(@Size(min = 12, max = 100) String password) {
        if (passwordSeed == null) {
            this.passwordSeed = DigestUtils.sha256Hex(random.generateSeed(32));
        }
        this.password = DigestUtils.sha256Hex(password + this.passwordSeed);
    }
}

Note that outside of the model, no hashing or manipulation of the password is done.

So how would I correctly approach this to have a simple validation that checks the minimum length of 12 characters and max of 100 ones?

8
  • As said here, @Size is not related to validation, so you shouldn't use it. You need to validate it some other way. Nov 1, 2018 at 12:02
  • 1
    @M. Prokhorov Really??? Size is a Bean Validation annotation that validates that the associated String has a value whose length is bounded by the minimum and maximum values.
    – user10527814
    Nov 1, 2018 at 12:04
  • It is acceptable for you to perform manual validation? (Something like ValidatorFactory factory = Validation.buildDefaultValidatorFactory(); etc.)
    – user10527814
    Nov 1, 2018 at 12:13
  • On further inspection, I was indeed wrong on that. Then this is a case of altering your values before. Although, have you tried also annotating parameters with @Valid? I'm talking about in second code block. Nov 1, 2018 at 12:14
  • 1
    IIRC, but don't the constraints have to be applied to either the field or the getter and not the setter? If this is a persistent class, is there a DTO/model class that you annotate; one that contains the raw password that you can validate against before you get into this code? Otherwise, what about creating a transient property that has the unhashed property? You could then apply the validation constraint to that property, and when you set that property, it sets the real hashed property that gets persisted. Since the unhashed version is transient, it won't get persisted. Just a little kludgy. Nov 1, 2018 at 12:37

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.