# 1. {noop} passwords: still work, still deprecated, no runtime warning

[README](../README.md) | Next: [RestClient with Basic Auth, two ways](02-restclient-basic-auth-patterns.md)

Source: [`AppSecurityConfig.java`](../src/main/java/com/ankurm/restclientbasicauth/config/AppSecurityConfig.java).

## What was checked, and why

The original article used `User.builder().password("{noop}password123")` with the comment "for
demonstration purposes only." Before repeating that pattern in a rewrite, it seemed worth checking
whether Boot 4.1 actually does anything different with it now -- log a deprecation warning, refuse
to start, anything.

It does not. A throwaway application built with exactly that `{noop}` password, run standalone with
`java -jar`, produces no warning in the full startup log, and a subsequent Basic-Auth request that
successfully authenticates against it produces no warning either. `NoOpPasswordEncoder` is
`@Deprecated` in Spring Security's own source and has been for years, but that annotation is a
compile-time signal to whoever writes the code, not a runtime one -- nothing tells an operator
watching logs in production that a demo shortcut is still live.

That is precisely the failure mode worth naming: a comment reading "for demonstration purposes
only" is not enforced by anything at runtime. This module uses
`PasswordEncoderFactories.createDelegatingPasswordEncoder()` (Spring Security's own recommended
default, currently BCrypt) instead, so the encoded value in the user store is not silently
reversible plaintext even in a demo.

## Going deeper

- [Spring Security password storage reference](https://docs.spring.io/spring-security/reference/features/authentication/password-storage.html) (rel="nofollow")
- Next: [RestClient with Basic Auth, two ways](02-restclient-basic-auth-patterns.md)