asmhatre/spring-boot-demo
1
0
Fork 0
Code Activity

Add custom-validation, etag-caching, restclient-basic-auth: Boot 4.1 API pass

Browse Source 
Three companion modules verifying and rewriting the Boot 4.1.1 / Framework
7.0.9 story for three older articles: the javax->jakarta.validation namespace
fix plus Jakarta Validation 3.1 record-validation clarification, ETag/
conditional-request APIs re-verified unchanged plus the starter rename, and
RestTemplate Basic Auth rebuilt on RestClient with the exchange() trap called
out. 19 real passing tests generate every transcript quoted from the three
companion articles.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EQNA6DJ9VgCtW6zhCE8Xud
This commit is contained in:
Claude
2026-09-19 10:17:09 +00:00
parent 03bdf7ee87
commit e4b5636f7c
75 changed files with 2374 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
restclient-basic-auth/docs/01-password-encoding.md
+30
View File
@@ -0,0 +1,30 @@
# 1. {noop} passwords: still work, still deprecated, no runtime warning
[README](../README.md) | Next: [RestClient with Basic Auth, two ways](02-restclient-basic-auth-patterns.md)
Source: [`AppSecurityConfig.java`](../src/main/java/com/ankurm/restclientbasicauth/config/AppSecurityConfig.java).
## What was checked, and why
The original article used `User.builder().password("{noop}password123")` with the comment "for
demonstration purposes only." Before repeating that pattern in a rewrite, it seemed worth checking
whether Boot 4.1 actually does anything different with it now -- log a deprecation warning, refuse
to start, anything.
It does not. A throwaway application built with exactly that `{noop}` password, run standalone with
`java -jar`, produces no warning in the full startup log, and a subsequent Basic-Auth request that
successfully authenticates against it produces no warning either. `NoOpPasswordEncoder` is
`@Deprecated` in Spring Security's own source and has been for years, but that annotation is a
compile-time signal to whoever writes the code, not a runtime one -- nothing tells an operator
watching logs in production that a demo shortcut is still live.
That is precisely the failure mode worth naming: a comment reading "for demonstration purposes
only" is not enforced by anything at runtime. This module uses
`PasswordEncoderFactories.createDelegatingPasswordEncoder()` (Spring Security's own recommended
default, currently BCrypt) instead, so the encoded value in the user store is not silently
reversible plaintext even in a demo.
## Going deeper
- [Spring Security password storage reference](https://docs.spring.io/spring-security/reference/features/authentication/password-storage.html) (rel="nofollow")
- Next: [RestClient with Basic Auth, two ways](02-restclient-basic-auth-patterns.md)