diff options
| author | Stefan Suhren <suhren.stefan@fh-swf.de> | 2015-10-26 10:17:15 +0100 |
|---|---|---|
| committer | Stefan Suhren <suhren.stefan@fh-swf.de> | 2015-10-26 10:17:15 +0100 |
| commit | 726d30ae4db5643e00b1bedcad132b05e2d6e091 (patch) | |
| tree | 183880e8d8a01ba395432ddd472dd87795eb92fe /src/de/fhswf/in/inf/fit | |
| parent | 575876a19885949f62a2b10e7885b00e9816919c (diff) | |
| download | FIT-726d30ae4db5643e00b1bedcad132b05e2d6e091.tar.gz FIT-726d30ae4db5643e00b1bedcad132b05e2d6e091.zip | |
Only store hashed and base64 encoded password
Diffstat (limited to 'src/de/fhswf/in/inf/fit')
| -rw-r--r-- | src/de/fhswf/in/inf/fit/aufgabe3/LoginServlet.java | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/src/de/fhswf/in/inf/fit/aufgabe3/LoginServlet.java b/src/de/fhswf/in/inf/fit/aufgabe3/LoginServlet.java index 7f56c3e..a3b06e6 100644 --- a/src/de/fhswf/in/inf/fit/aufgabe3/LoginServlet.java +++ b/src/de/fhswf/in/inf/fit/aufgabe3/LoginServlet.java @@ -4,6 +4,7 @@ import java.io.IOException; import java.io.PrintWriter; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; +import java.util.Base64; import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; @@ -68,9 +69,8 @@ public class LoginServlet extends HttpServlet pw.println("<body>"); // This is very insecure and can be exploited via timing attacks - if (requestUsername.equals(validUsername) - && createSaltedPasswordHash(validPassword, salt) - .equals(createSaltedPasswordHash(requestPassword, salt))) + if (requestUsername.equals(validUsername) && validPassword + .equals(createSaltedPasswordHash(requestPassword, salt))) { pw.println("<h1>Success</h1>"); request.getSession().setAttribute("loggedin", true); @@ -86,7 +86,7 @@ public class LoginServlet extends HttpServlet } /** - * Generate a SHA-1 encoded password that is salted. + * Generate a Base64 encoded SHA-1 hashed password that is salted. * * @param password * The password to encode. @@ -110,7 +110,7 @@ public class LoginServlet extends HttpServlet { MessageDigest md = MessageDigest.getInstance("SHA-1"); md.update((password + salt).getBytes()); - return new String(md.digest()); + return Base64.getEncoder().encodeToString(md.digest()); } catch (NoSuchAlgorithmException e) { |