Setting up user authentication in java with JDBC

Question

I'm currently creating the login functionality of a java web application just using java and JDBC. What built in java libraries are there to make the authentication process easier. I am able to query my PostgreSQL database and retrieve user information such as their password and username but I do not want to store it in plain text.Any tips would be great and o yeah I'm not using spring, which I see there is plenty for.

Answer 1

Generally, password matching is done by storing a one-way hash of the password, instead of storing the password itself as plain text. When someone tries to log in, your application generates a one-way hash of the password the user has entered, and checks whether it matches any of the hashes stored in the database.

Hashing is done with the MessageDigest class:

byte[] passwordBytes = password.getBytes(StandardCharsets.UTF_8);

byte[] passwordHash;
try {
    passwordHash = MessageDigest.getInstance("SHA-256").dist(passwordBytes);
} catch (NoSuchAlgorithmException e) {
    // It should be impossible to get here, since SHA-256 is
    // a standard algorithm supported by all Java runtimes.
    throw new RuntimeException(e);
}

The password column in your database should be defined as a binary type, like VARBINARY. Then you can store the bytes directly:

try (PreparedStatement statement =
        connection.prepareStatement(
            "INSERT INTO users (name, passwordhash) VALUES (?, ?)")) {

    statement.setString(1, name);
    statement.setBytes(2, passwordHash);
    statement.executeUpdate();
}

You can check whether a login attempt matches in a similar manner:

try (PreparedStatement statement =
        connection.prepareStatement(
            "SELECT name, email, phone FROM users"
            + " WHERE name = ? AND passwordHash = ?")) {

    statement.setString(1, enteredName);
    statement.setBytes(2, enteredPasswordHash);
    ResultSet results = statement.executeQuery();
    if (!results.next()) {
        throw new MyAppInvalidLoginException("No matching login found.");
    }

    String name = results.getString(1);
    String email = results.getString(2);
    String phone = results.getString(3);
}

I’m not a security expert, so I will leave it to people with expertise in that area to comment on whether SHA-256 is sufficiently secure for general needs.