Replace our own `PasswordHasher` with `BCryptPasswordEncoder` in `budgeteer-web-interface`
czarnecki opened this issue · 0 comments
czarnecki commented
The budgeteer-web-interface
currently uses SHA-512 without any salt to hash passwords. This isn't optimal since it's possible to lookup the unhashed passwords using a rainbow table. As such we should strive to use a better method of hashing passwords, like the BCryptPasswordEncoder
provided by Spring Security.
As part of this effort we also need to rehash passwords that are still hashed using the old hashing algorithm. This check should be done everytime a user logs in.