CODEWITHSUNDEEP
javamysqlspring-bootsecuritybcrypt
bg9848
bg9848

Reputation: 322

Java spring boot encrypt admin password before storing it in database?

I require an admin user to be initialized in the database because to register a new account admin permission is required. The problem is when I enable encryption (encrypt all registered users passwords), it also tries to decrypt the initialized admin password and returns error:

Encoded password does not look like BCrypt

I am thinking I can somehow encrypt the initialized admin password before storing it in the database (MySQL). But I am unsure of how to go about doing this. Any tips?

Currently, I am initializing the database with the admin user by using SQL queries.

Upvotes: 1

Views: 1663

Answers (2)

Andry Shutka
Andry Shutka

Reputation: 413

In this case you should override you old plain-saved password by the encrypted one directly in DB. Or drop and recreate your account according to new rules

To do this you can type your plain password to site like this https://www.browserling.com/tools/bcrypt set round to 10 (this is value that Spring bean uses by default) and it will give you encrypted password. just replace it in DB

Upvotes: 3

Reaz Murshed
Reaz Murshed

Reputation: 24211

IMHO, I am not sure if MySQL has a default BCrypt encryption function. I guess that you have the bcrypt installed in your machine which you are using for the passwords to be encrypted. If that is the case, I would not recommend using the database-level encryption.

I think another problem with the database level encryption is, the data you are passing to the database, might end up stored in the database log or server logs. Hence, you might lose the confidentiality of the passwords.

If I had to design the system, I might have gone for the application-level encryption and would let the Spring-Boot application to handle this.

Upvotes: 0

Related Questions