I need to encrypt the password from client side using java gwt but import java.security is not available

Question

when i try to compile in java gwt its displaying the issues below

The import java.security cannot be resolved
MessageDigest cannot be resolved to a type
NoSuchAlgorithmException cannot be resolved to a type

note: versions used gwt 2.0 java 6 (jre 1.6) tried in 1.8 as well

public static String EncryptPassowrd(String password)
    {
        String encryptedPassword = "";
        byte[] actualBytes = password.toString().getBytes();
        byte[] newbytes = new byte[actualBytes.length * 2];
        for (int i = 0; i < actualBytes.length; i++)
        {
            newbytes[2 * i] = actualBytes[i];
            newbytes[2 * i + 1] = 0;
        }
        try
        {
            MessageDigest md = MessageDigest.getInstance("SHA-1");
            md.reset();
            md.update(newbytes);
            byte[] encryptedbytes = md.digest();
            for (int i = 0; i < encryptedbytes.length; i++)
            {
                encryptedPassword = encryptedPassword == "" ? Integer.toString((encryptedbytes[i] & 0xff) + 0x100, 16).substring(1) : encryptedPassword + "-"
                    + Integer.toString((encryptedbytes[i] & 0xff) + 0x100, 16).substring(1);
            }
            return encryptedPassword.toUpperCase();
        }
        catch (NoSuchAlgorithmException e)
        {
            // Do Nothing
        }
        return "";
    }

updated the Question with code please go through it@FabioAssuncao — Sasikumar Kasaram, Feb 08 '21 at 06:38
This looks like what you need https://stackoverflow.com/questions/4895523/java-string-to-sha1 — Sergey Nemchinov, Feb 09 '21 at 08:09

score 5 · Answer 1 · answered Feb 08 '21 at 17:06

java.security is not included in the subset of the Java runtime library that GWT emulates, as it was already mentioned.

Although you could use GWT-Crypto to go around it, password encryption is not secure, especially on the client side - check GWT-Crypto own wiki. Instead, the plain text password should be sent over an encrypted channel (SSL) and processed securely on the server (for example, hashed with bcrypt). Since hash functions are one-way function, you won't be able to "decrypt" the hashes. In order to authenticate your user, you can run the password through the hash function again in order to compare with the hash that is stored in the database.

score 1 · Answer 2 · answered Feb 08 '21 at 14:23

1

The package java.security is not part of GWT's standard library emulation.

So you cannot use such classes in GWT client side code. Use special GWT encryption libraries like gwt-crypto instead.

answered Feb 08 '21 at 14:23

vanje

10,180
2
31
47

I need to encrypt the password from client side using java gwt but import java.security is not available

2 Answers2