Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-27 06:12:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Improve PasswordEncoder deprecated notices

Browse Source 
Fixes: gh-5296
This commit is contained in:
Rob Winch 2018-05-03 15:13:06 -05:00
parent 948e650a0e
commit 0a5da93640
5 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
core/src/main/java/org/springframework/security/core/userdetails/User.java
View File

@ -326,6 +326,8 @@ public class User implements UserDetails, CredentialsContainer {
* @deprecated Using this method is not considered safe for production, but is * @deprecated Using this method is not considered safe for production, but is
* acceptable for demos and getting started. For production purposes, ensure the * acceptable for demos and getting started. For production purposes, ensure the
* password is encoded externally. See the method Javadoc for additional details. * password is encoded externally. See the method Javadoc for additional details.
* There are no plans to remove this support. It is deprecated to indicate
* that this is considered insecure for production purposes.
*/ */
@Deprecated @Deprecated
public static UserBuilder withDefaultPasswordEncoder() { public static UserBuilder withDefaultPasswordEncoder() {

3
crypto/src/main/java/org/springframework/security/crypto/password/LdapShaPasswordEncoder.java
View File

@ -39,7 +39,8 @@ import java.util.Base64;
* @deprecated Digest based password encoding is not considered secure. Instead use an * @deprecated Digest based password encoding is not considered secure. Instead use an
* adaptive one way funciton like BCryptPasswordEncoder, Pbkdf2PasswordEncoder, or * adaptive one way funciton like BCryptPasswordEncoder, Pbkdf2PasswordEncoder, or
* SCryptPasswordEncoder. Even better use {@link DelegatingPasswordEncoder} which supports * SCryptPasswordEncoder. Even better use {@link DelegatingPasswordEncoder} which supports
* password upgrades. * password upgrades. There are no plans to remove this support. It is deprecated to indicate
* that this is a legacy implementation and using it is considered insecure.
*/ */
@Deprecated @Deprecated
public class LdapShaPasswordEncoder implements PasswordEncoder { public class LdapShaPasswordEncoder implements PasswordEncoder {

3
crypto/src/main/java/org/springframework/security/crypto/password/Md4PasswordEncoder.java
View File

@ -73,7 +73,8 @@ import java.util.Base64;
* @deprecated Digest based password encoding is not considered secure. Instead use an * @deprecated Digest based password encoding is not considered secure. Instead use an
* adaptive one way funciton like BCryptPasswordEncoder, Pbkdf2PasswordEncoder, or * adaptive one way funciton like BCryptPasswordEncoder, Pbkdf2PasswordEncoder, or
* SCryptPasswordEncoder. Even better use {@link DelegatingPasswordEncoder} which supports * SCryptPasswordEncoder. Even better use {@link DelegatingPasswordEncoder} which supports
* password upgrades. * password upgrades. There are no plans to remove this support. It is deprecated to indicate
* that this is a legacy implementation and using it is considered insecure.
*/ */
@Deprecated @Deprecated
public class Md4PasswordEncoder implements PasswordEncoder { public class Md4PasswordEncoder implements PasswordEncoder {

3
crypto/src/main/java/org/springframework/security/crypto/password/MessageDigestPasswordEncoder.java
View File

@ -76,7 +76,8 @@ import java.util.Base64;
* @deprecated Digest based password encoding is not considered secure. Instead use an * @deprecated Digest based password encoding is not considered secure. Instead use an
* adaptive one way funciton like BCryptPasswordEncoder, Pbkdf2PasswordEncoder, or * adaptive one way funciton like BCryptPasswordEncoder, Pbkdf2PasswordEncoder, or
* SCryptPasswordEncoder. Even better use {@link DelegatingPasswordEncoder} which supports * SCryptPasswordEncoder. Even better use {@link DelegatingPasswordEncoder} which supports
* password upgrades. * password upgrades. There are no plans to remove this support. It is deprecated to indicate
* that this is a legacy implementation and using it is considered insecure.
*/ */
@Deprecated @Deprecated
public class MessageDigestPasswordEncoder implements PasswordEncoder { public class MessageDigestPasswordEncoder implements PasswordEncoder {

5
crypto/src/main/java/org/springframework/security/crypto/password/StandardPasswordEncoder.java
View File

@ -41,9 +41,10 @@ import org.springframework.security.crypto.keygen.KeyGenerators;
* @author Keith Donald * @author Keith Donald
* @author Luke Taylor * @author Luke Taylor
* @deprecated Digest based password encoding is not considered secure. Instead use an * @deprecated Digest based password encoding is not considered secure. Instead use an
* adaptive one way funciton like BCryptPasswordEncoder, Pbkdf2PasswordEncoder, or * adaptive one way function like BCryptPasswordEncoder, Pbkdf2PasswordEncoder, or
* SCryptPasswordEncoder. Even better use {@link DelegatingPasswordEncoder} which supports * SCryptPasswordEncoder. Even better use {@link DelegatingPasswordEncoder} which supports
* password upgrades. * password upgrades. There are no plans to remove this support. It is deprecated to indicate
* that this is a legacy implementation and using it is considered insecure.
*/ */
@Deprecated @Deprecated
public final class StandardPasswordEncoder implements PasswordEncoder { public final class StandardPasswordEncoder implements PasswordEncoder {