Spring Security--PasswordEncoder详解

Becoming Involved

Spring Security封装了如bcrypt, PBKDF2, scrypt, Argon2等主流适应性单向加密方法（ adaptive one-way functions），用以进行密码存储和校验。单向校验安全性高，但开销很大，单次密码校验耗时可能高达1秒，故针对高并发性能要求较强的大型信息系统，Spring Security更推荐选择如：session, OAuth，Token等开销很小的短期加密策略（short term credential）实现系统信息安全。

Delegating PasswordEncoder

使用PasswordEncoderFactories创建需要的Encoder，Spring Security集成的PasswordEncoder的id如下：

PasswordEncoder passwordEncoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();

//或自定义创建PasswordEncoder
String idForEncode = "bcrypt";
Map encoders = new HashMap<>();
encoders.put(idForEncode, new BCryptPasswordEncoder());
encoders.put("noop", NoOpPasswordEncoder.getInstance());

PasswordEncoder passwordEncoder = new DelegatingPasswordEncoder(idForEncode, encoders);