Login errors in spring boot: Encoded password does not look like BCrypt - spring

Question

I ran my spring boot project in idea, register, then I have the problem when I login. It redirected to the "localhost:8080/login?error" and has the following in idea console
Encoded password does not look like BCrypt
I've searched the answer in stackoverflow and saw this the link. But It seems to be useless to me because my configure extends WebSecurityConfigurerAdapter not AuthorizationServerConfigurerAdapter. My configure class is
#Configuration
#EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
#Autowired
private WorkersRepository workersRepository;
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/submit").access("hasRole('WORKER')")
.anyRequest().permitAll()
.and()
.formLogin()
.loginPage("/login")
.and()
.logout()
.logoutSuccessUrl("/")
.and()
.rememberMe()
.tokenValiditySeconds(4838400)
.key("workerKey");
}
#Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(new UserDetailsService() {
#Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
Worker worker = workersRepository.findByUsername(username);
return workersRepository.findByUsername(username);
}
}).passwordEncoder(new BCryptPasswordEncoder()).and()
.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder())
.withUser("admin").password("123456").roles("ADMIN","WORKER");
}
}
My Worker class is
#Entity
public class Worker implements UserDetails {
private static final long serialversionUID = 1L;
#Id
#GeneratedValue(strategy = GenerationType.AUTO)
private Long id;
#NotNull
#Size(min = 5, max = 16, message = "{username.size}")
private String username;
#NotNull
#Size(min = 2, max = 30, message = "{firstName.size}")
private String firstname;
#NotNull
#Size(min = 2, max = 30, message = "{lastName.size")
private String lastname;
#NotNull
#Size(min = 5, max = 25,message = "{password.size}")
private String password;
#NotNull
#Size(min = 2, max = 30, message = "{profession,size}")
private String profession;
public String getUsername() {
return username;
}
public void setUsername(String username) {
this.username = username;
}
public String getFirstname() {
return firstname;
}
public void setFirstname(String firstname) {
this.firstname = firstname;
}
public String getLastname() {
return lastname;
}
public void setLastname(String lastname) {
this.lastname = lastname;
}
public String getPassword() {
return password;
}
public void setPassword(String password) {
this.password = password;
}
public String getProfession() {
return profession;
}
public void setProfession(String profession) {
this.profession = profession;
}
public Long getId() {
return id;
}
public void setId(Long id) {
this.id = id;
}
//UserDetails methods
#Override
public Collection<? extends GrantedAuthority> getAuthorities() {
return Arrays.asList(new SimpleGrantedAuthority("WORKER"));
}
#Override
public boolean isAccountNonExpired() {
return true;
}
#Override
public boolean isAccountNonLocked() {
return true;
}
#Override
public boolean isCredentialsNonExpired() {
return true;
}
#Override
public boolean isEnabled() {
return true;
}
}
My WorkersRepository is
package com.rieunity.workinghours;
import org.springframework.data.jpa.repository.JpaRepository;
public interface WorkersRepository extends JpaRepository<Worker, String> {
Worker findByUsername(String username);
}
I did not login with user admin, I registered a new user in register.html and succeeded. Then I login in login page and failed with the error:
Encoded password does not look like BCrypt
Did I miss something?

Answer 1

I've solved the problem. Since I encoded the password by using BCryptPasswordEncoder, I should store the password in this form. Hence the solution is adding
String encodedPassword = new BCryptPasswordEncoder().encode(worker.getPassword());
worker.setPassword(encodedPassword);
into the "/register" post request
#RequestMapping(value = "/register", method = RequestMethod.POST)
public String registrationProcessing(#Valid Worker worker, Errors errors, RedirectAttributes model) {
if(errors.hasErrors()) {
return "registerForm";
};
String encodedPassword = new BCryptPasswordEncoder().encode(worker.getPassword());
worker.setPassword(encodedPassword);
workersRepository.save(worker);
model.addAttribute("username", worker.getUsername());
model.addFlashAttribute("worker", worker);
return "redirect:/";
}

Answer 2

The password field for a BCrypt should be at least 60 character because the result hash has 60 char.
#Size(min = 5, max = 60,message = "{password.size}")
private String password;

Answer 3

I had a same issue and solution is simple , first open online Bcrypt ecrypter site in browser :
https://www.dailycred.com/article/bcrypt-calculator
and first try in here.Java is use 12 number of rounds in Brcypt as default.You must use 12 ! not another number.