Authentication with Spring Security

The day a database leaks, the only thing still protecting your users is how their passwords were stored. This is not a pessimistic hypothesis: tens of millions of accounts circulate in public lists, and the vast majority come from databases where passwords were stored in plaintext, or hashed with an algorithm designed to be fast. An MD5-hashed password can be recovered in seconds on a used GPU.

Authentication is therefore the part of the course where correctness matters most. Everything else — URL rules, roles, tokens — protects a session; hashing protects your users after the incident, including on the other sites where they reused the same password.

Spring Security takes this seriously, to the point of refusing to start if you store a password without specifying the algorithm used. This lesson shows how to plug in your own users, which encoder to choose, and how to handle failures without handing an attacker a list of your valid accounts.

You will also see the two pieces missing from most tutorials: what exactly DaoAuthenticationProvider does between the form and your database, and why an overly specific error message is enough to enumerate your users.