Spring Security - Password Storage

Password storage in Spring Security is the process of securely saving user passwords by encoding them before they are stored in a database. Instead of storing plain text passwords, Spring Security uses strong password encoders to protect user credentials from unauthorized access.

• Stores passwords in encoded (hashed) form.
• Prevents exposure of plain text passwords.
• Supports secure encoders like BCryptPasswordEncoder.

Why Secure Password Storage is Important

Improper password storage can lead to serious security risks:

• Brute Force Attacks: Weakly stored passwords can be guessed using automated attacks.
• Password Theft: Plain-text passwords can be directly exposed if the database is leaked.
• Data Breaches: Attackers may gain access to sensitive user information.
• Legal and Compliance Issues: Organizations may face penalties for insecure password handling.

Techniques for Password Storage in Spring Security

Hashing

Hashing converts a plain-text password into a fixed-length irreversible hash value. The original password cannot be retrieved from the hash.Common Hashing Algorithms are :

• BCrypt: Most commonly used and automatically includes salting.
• PBKDF2: Uses iterations and salt for stronger security.
• SCrypt: Memory-intensive and resistant to hardware attacks.
• Argon2: Modern and highly secure password hashing algorithm.

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

PasswordEncoder encoder = new BCryptPasswordEncoder();
String encodedPassword = encoder.encode("mypassword");

Explanation: The password is converted into a secure hash before storing it in the database. During login, Spring Security compares the entered password with the stored hash.

Salting

Salting adds a random value to the password before hashing. This prevents identical passwords from generating the same hash.

• Protects against rainbow table attacks.
• Makes password cracking more difficult.
• Ensures unique hashes for each user.

PasswordEncoder encoder = new BCryptPasswordEncoder();

Explanation: Even if two users have the same password, their stored hashes will be different because of unique salts.

Peppering

Peppering adds a secret value (pepper) to passwords before hashing. Unlike salt, the pepper is not stored in the database.

• Adds an additional security layer.
• Protects passwords even if the database is compromised.

String pepper = "SecretKey";
String password = "mypassword" + pepper;

Explanation: The application combines the password with a secret key before hashing, making password cracking harder.

4. Encryption

Encryption is a security technique that converts readable data into an unreadable format using an encryption key. The encrypted data can later be converted back into its original form using a decryption key.

• Uses encryption and decryption keys for data protection.
• Data can be restored to its original form.

import org.springframework.security.crypto.encrypt.Encryptors;
import org.springframework.security.crypto.encrypt.TextEncryptor;

public class EncryptionExample {
    public static void main(String[] args) {

        String password = "secretKey";
        String salt = "12345678";

        TextEncryptor encryptor =
                Encryptors.text(password, salt);

        String encrypted =
                encryptor.encrypt("Sensitive Data");

        System.out.println("Encrypted: " + encrypted);

        String decrypted =
                encryptor.decrypt(encrypted);

        System.out.println("Decrypted: " + decrypted);
    }
}

Output:

Encrypted: 8fKx2L...
Decrypted: Sensitive Data

Explanation: In this example, Spring Security encrypts the text "Sensitive Data" using a secret key and salt. The encrypted value is unreadable and can only be restored using the correct decryption key.

Comparing Password Storage Techniques

Additional Security Measures

• Two-Factor Authentication (2FA): Adds an extra verification step along with the password for better account security.
• Rate Limiting: Restricts repeated login attempts to prevent brute-force attacks.
• CAPTCHA: Prevents automated bots from attempting password guessing.
• Role-Based Access Control (RBAC): Restricts resource access based on user roles and permissions.
• HTTPS Security: Encrypts communication between client and server to protect sensitive data.
• Strong Password Policies: Enforces secure password creation with rules like length and special characters.
• Account Locking: Temporarily locks accounts after multiple failed login attempts.