Claude
e4b5636f7c
Three companion modules verifying and rewriting the Boot 4.1.1 / Framework 7.0.9 story for three older articles: the javax->jakarta.validation namespace fix plus Jakarta Validation 3.1 record-validation clarification, ETag/ conditional-request APIs re-verified unchanged plus the starter rename, and RestTemplate Basic Auth rebuilt on RestClient with the exchange() trap called out. 19 real passing tests generate every transcript quoted from the three companion articles. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EQNA6DJ9VgCtW6zhCE8Xud
31 lines
1.8 KiB
Markdown
31 lines
1.8 KiB
Markdown
# 1. {noop} passwords: still work, still deprecated, no runtime warning
|
|
|
|
[README](../README.md) | Next: [RestClient with Basic Auth, two ways](02-restclient-basic-auth-patterns.md)
|
|
|
|
Source: [`AppSecurityConfig.java`](../src/main/java/com/ankurm/restclientbasicauth/config/AppSecurityConfig.java).
|
|
|
|
## What was checked, and why
|
|
|
|
The original article used `User.builder().password("{noop}password123")` with the comment "for
|
|
demonstration purposes only." Before repeating that pattern in a rewrite, it seemed worth checking
|
|
whether Boot 4.1 actually does anything different with it now -- log a deprecation warning, refuse
|
|
to start, anything.
|
|
|
|
It does not. A throwaway application built with exactly that `{noop}` password, run standalone with
|
|
`java -jar`, produces no warning in the full startup log, and a subsequent Basic-Auth request that
|
|
successfully authenticates against it produces no warning either. `NoOpPasswordEncoder` is
|
|
`@Deprecated` in Spring Security's own source and has been for years, but that annotation is a
|
|
compile-time signal to whoever writes the code, not a runtime one -- nothing tells an operator
|
|
watching logs in production that a demo shortcut is still live.
|
|
|
|
That is precisely the failure mode worth naming: a comment reading "for demonstration purposes
|
|
only" is not enforced by anything at runtime. This module uses
|
|
`PasswordEncoderFactories.createDelegatingPasswordEncoder()` (Spring Security's own recommended
|
|
default, currently BCrypt) instead, so the encoded value in the user store is not silently
|
|
reversible plaintext even in a demo.
|
|
|
|
## Going deeper
|
|
|
|
- [Spring Security password storage reference](https://docs.spring.io/spring-security/reference/features/authentication/password-storage.html) (rel="nofollow")
|
|
- Next: [RestClient with Basic Auth, two ways](02-restclient-basic-auth-patterns.md)
|