adessoSE/budgeteer

Replace our own `PasswordHasher` with `BCryptPasswordEncoder` in `budgeteer-web-interface`

czarnecki opened this issue · 0 comments

The budgeteer-web-interface currently uses SHA-512 without any salt to hash passwords. This isn't optimal since it's possible to lookup the unhashed passwords using a rainbow table. As such we should strive to use a better method of hashing passwords, like the BCryptPasswordEncoder provided by Spring Security.
As part of this effort we also need to rehash passwords that are still hashed using the old hashing algorithm. This check should be done everytime a user logs in.