Claude
e4b5636f7c
Three companion modules verifying and rewriting the Boot 4.1.1 / Framework 7.0.9 story for three older articles: the javax->jakarta.validation namespace fix plus Jakarta Validation 3.1 record-validation clarification, ETag/ conditional-request APIs re-verified unchanged plus the starter rename, and RestTemplate Basic Auth rebuilt on RestClient with the exchange() trap called out. 19 real passing tests generate every transcript quoted from the three companion articles. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EQNA6DJ9VgCtW6zhCE8Xud
1.8 KiB
1. {noop} passwords: still work, still deprecated, no runtime warning
README | Next: RestClient with Basic Auth, two ways
Source: AppSecurityConfig.java.
What was checked, and why
The original article used User.builder().password("{noop}password123") with the comment "for
demonstration purposes only." Before repeating that pattern in a rewrite, it seemed worth checking
whether Boot 4.1 actually does anything different with it now -- log a deprecation warning, refuse
to start, anything.
It does not. A throwaway application built with exactly that {noop} password, run standalone with
java -jar, produces no warning in the full startup log, and a subsequent Basic-Auth request that
successfully authenticates against it produces no warning either. NoOpPasswordEncoder is
@Deprecated in Spring Security's own source and has been for years, but that annotation is a
compile-time signal to whoever writes the code, not a runtime one -- nothing tells an operator
watching logs in production that a demo shortcut is still live.
That is precisely the failure mode worth naming: a comment reading "for demonstration purposes
only" is not enforced by anything at runtime. This module uses
PasswordEncoderFactories.createDelegatingPasswordEncoder() (Spring Security's own recommended
default, currently BCrypt) instead, so the encoded value in the user store is not silently
reversible plaintext even in a demo.
Going deeper
- Spring Security password storage reference (rel="nofollow")
- Next: RestClient with Basic Auth, two ways