From 4f97217f684d706ab6074382af91e5b538d00d96 Mon Sep 17 00:00:00 2001 From: Andrey Litvitski Date: Mon, 23 Feb 2026 22:26:33 +0300 Subject: [PATCH] Refine upgradeEncoding condition in DaoAuthenticationProvider After adding jspecify support in the module that contains the DaoAuthenticationProvider class, we actually changed the contract logic, which is a good thing, and this commit fixes it. Closes: gh-18781 Signed-off-by: Andrey Litvitski --- .../authentication/dao/DaoAuthenticationProvider.java | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/core/src/main/java/org/springframework/security/authentication/dao/DaoAuthenticationProvider.java b/core/src/main/java/org/springframework/security/authentication/dao/DaoAuthenticationProvider.java index c599a1504f..093b849c3d 100644 --- a/core/src/main/java/org/springframework/security/authentication/dao/DaoAuthenticationProvider.java +++ b/core/src/main/java/org/springframework/security/authentication/dao/DaoAuthenticationProvider.java @@ -16,6 +16,7 @@ package org.springframework.security.authentication.dao; +import java.util.Objects; import java.util.function.Supplier; import org.jspecify.annotations.Nullable; @@ -43,6 +44,7 @@ import org.springframework.util.function.SingletonSupplier; * * @author Ben Alex * @author Rob Winch + * @author Andrey Litvitski */ public class DaoAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider { @@ -131,7 +133,8 @@ public class DaoAuthenticationProvider extends AbstractUserDetailsAuthentication throw new CompromisedPasswordException("The provided password is compromised, please change your password"); } String existingEncodedPassword = user.getPassword(); - boolean upgradeEncoding = existingEncodedPassword != null && this.userDetailsPasswordService != null + boolean upgradeEncoding = existingEncodedPassword != null + && !Objects.equals(this.userDetailsPasswordService, UserDetailsPasswordService.NOOP) && this.passwordEncoder.get().upgradeEncoding(existingEncodedPassword); if (upgradeEncoding) { String newPassword = this.passwordEncoder.get().encode(presentedPassword);