如何将文本密码与使用 spring data jpa 散列的密码进行比较？

Question

我的密码在保存时在数据库中进行了哈希处理。但是我现在正在实现登录模块，并且无法在 spring [boot] data jpa 中比较两个密码。这是尝试将我输入的文本密码与在数据库中散列的密码进行比较，这显然失败了。

我知道这个问题已经回答here using java 用于一般情况，但不适用于弹簧靴。

我需要在这段代码中操作逻辑

@Override
public boolean getLoggedinUser(User user) {

    String uname = user.getUsername();
    String email = user.getEmail();
    String password = user.getPassword();

    System.out.println("sanity check username----- " + uname  + 
            " password ------- " + password);

    if ((userRepo.findByUsername(uname) != null && userRepo.findByPassword(password) != null)
            || (userRepo.findByPassword(password) != null && userRepo.findByEmail(email) != null)) {

        return true;
    }
    else return false;
}

现在，如何比较它们？任何解决方案表示赞赏。

Answer 1

我将其用作开箱即用的解决方案，它全部由 spring 管理

@RestController
@RequestMapping("/api")
public class UserJWTController {



private final AuthenticationManagerBuilder authenticationManagerBuilder;

public UserJWTController( AuthenticationManagerBuilder authenticationManagerBuilder, 
....other dependancies) {
    //other dependancies
    this.authenticationManagerBuilder = authenticationManagerBuilder;
}

@PostMapping("/authenticate")
public ResponseEntity<JWTToken> authorize(@Valid @RequestBody LoginVM loginVM) {

    String authenticateWith = loginVM.getEmail()==null? 
  loginVM.getUsername():loginVM.getEmail();
    if(authenticateWith==null||authenticateWith.trim().isEmpty()) {
        return ResponseEntity.badRequest().build();
    }

    UsernamePasswordAuthenticationToken authenticationToken =
        new UsernamePasswordAuthenticationToken(authenticateWith.toLowerCase(), 
   loginVM.getPassword());

    Authentication authentication = 
  authenticationManagerBuilder.getObject().authenticate(authenticationToken);
    SecurityContextHolder.getContext().setAuthentication(authentication);

Answer 2

我通过这种方式解决了上述问题。但是，如果我可以通过其他任何方式优化解决方案，请告诉我。

@Override
public boolean getLoggedinUser(User user) {
    String uname = user.getUsername();
    String email = user.getEmail();
    String password = user.getPassword();

    BCryptPasswordEncoder bcryptEncoder = new BCryptPasswordEncoder();

    User userWithUsername = userRepo.findByUsername(uname);//as username is unique
    User userWithEmail = userRepo.findByEmail(email); //unique email

    String hashedPassword = "";

     if(userWithUsername !=null) {
        hashedPassword = userWithUsername.getPassword();
      System.out.println("------------" + userWithUsername + " _------------- " + hashedPassword);
     }

     else if(userWithEmail !=null) {
            hashedPassword = userWithEmail.getPassword();
          System.out.println("------------" + userWithUsername + " _------------- " + hashedPassword);
     }

    boolean isPasswordMatched = bcryptEncoder.matches(password, hashedPassword);

if(((userWithUsername ==null && userWithEmail != null ) && userWithEmail.isEnabled() == false) || ((userWithEmail ==null && userWithUsername !=null) && userWithUsername.isEnabled() == false)) {   
        return false;
    }

    if ((userRepo.findByUsername(uname) !=null && isPasswordMatched) || (userRepo.findByEmail(email) !=null && isPasswordMatched)) {
        return true;
    }
   return false;
}