Berufsschule
/
m183-tresor
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

added hashing to registering new user

This commit is contained in:
Lorenz Hohermuth 2025-05-15 20:41:53 +02:00
parent 3408f01598
commit 36363716c1
6 changed files with 199 additions and 134 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
183_12_1_tresorbackend_rupe-master/pom.xml
View File

@ -66,6 +66,28 @@
<artifactId>jasypt-spring-boot-starter</artifactId>
<version>3.0.5</version>
</dependency>
<!-- Bouncy Castle for secure hashing and random salt generation -->
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-jdk18on</artifactId>
<version>1.76</version>
</dependency>
<!-- Spring Security for password encoding (bcrypt) -->
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-crypto</artifactId>
<version>6.1.2</version>
</dependency>
<!-- Apache Commons Codec for encoding (like Base64) -->
<dependency>
<groupId>commons-codec</groupId>
<artifactId>commons-codec</artifactId>
<version>1.16.0</version>
</dependency>
</dependencies>
<build>

253
183_12_1_tresorbackend_rupe-master/src/main/java/ch/bbw/pr/tresorbackend/controller/UserController.java
View File

@ -32,150 +32,153 @@ import java.util.stream.Collectors;
@RequestMapping("api/users")
public class UserController {
private UserService userService;
private PasswordEncryptionService passwordService;
private final ConfigProperties configProperties;
private static final Logger logger = LoggerFactory.getLogger(UserController.class);
private UserService userService;
private PasswordEncryptionService passwordService;
private final ConfigProperties configProperties;
private static final Logger logger = LoggerFactory.getLogger(UserController.class);
@Autowired
public UserController(ConfigProperties configProperties, UserService userService,
PasswordEncryptionService passwordService) {
this.configProperties = configProperties;
System.out.println("UserController.UserController: cross origin: " + configProperties.getOrigin());
// Logging in the constructor
logger.info("UserController initialized: " + configProperties.getOrigin());
logger.debug("UserController.UserController: Cross Origin Config: {}", configProperties.getOrigin());
this.userService = userService;
this.passwordService = passwordService;
}
@Autowired
public UserController(ConfigProperties configProperties, UserService userService,
PasswordEncryptionService passwordService) {
this.configProperties = configProperties;
System.out.println("UserController.UserController: cross origin: " + configProperties.getOrigin());
// Logging in the constructor
logger.info("UserController initialized: " + configProperties.getOrigin());
logger.debug("UserController.UserController: Cross Origin Config: {}", configProperties.getOrigin());
this.userService = userService;
this.passwordService = passwordService;
}
// build create User REST API
@CrossOrigin(origins = "${CROSS_ORIGIN}")
@PostMapping
public ResponseEntity<String> createUser(@Valid @RequestBody RegisterUser registerUser, BindingResult bindingResult) {
//captcha
//todo ergänzen
// build create User REST API
@CrossOrigin(origins = "${CROSS_ORIGIN}")
@PostMapping
public ResponseEntity<String> createUser(@Valid @RequestBody RegisterUser registerUser, BindingResult bindingResult) {
//captcha
//todo ergänzen
System.out.println("UserController.createUser: captcha passed.");
System.out.println("UserController.createUser: captcha passed.");
//input validation
if (bindingResult.hasErrors()) {
List<String> errors = bindingResult.getFieldErrors().stream()
.map(fieldError -> fieldError.getField() + ": " + fieldError.getDefaultMessage())
.collect(Collectors.toList());
System.out.println("UserController.createUser " + errors);
//input validation
if (bindingResult.hasErrors()) {
List<String> errors = bindingResult.getFieldErrors().stream()
.map(fieldError -> fieldError.getField() + ": " + fieldError.getDefaultMessage())
.collect(Collectors.toList());
System.out.println("UserController.createUser " + errors);
JsonArray arr = new JsonArray();
errors.forEach(arr::add);
JsonObject obj = new JsonObject();
obj.add("message", arr);
String json = new Gson().toJson(obj);
JsonArray arr = new JsonArray();
errors.forEach(arr::add);
JsonObject obj = new JsonObject();
obj.add("message", arr);
String json = new Gson().toJson(obj);
System.out.println("UserController.createUser, validation fails: " + json);
return ResponseEntity.badRequest().body(json);
}
System.out.println("UserController.createUser: input validation passed");
System.out.println("UserController.createUser, validation fails: " + json);
return ResponseEntity.badRequest().body(json);
}
System.out.println("UserController.createUser: input validation passed");
//password validation
//todo ergänzen
System.out.println("UserController.createUser, password validation passed");
//password validation
//todo ergänzen
System.out.println("UserController.createUser, password validation passed");
//transform registerUser to user
User user = new User(
null,
registerUser.getFirstName(),
registerUser.getLastName(),
registerUser.getEmail(),
passwordService.hashPassword(registerUser.getPassword())
);
//transform registerUser to user
String salt = PasswordEncryptionService.generateSalt();
User savedUser = userService.createUser(user);
System.out.println("UserController.createUser, user saved in db");
JsonObject obj = new JsonObject();
obj.addProperty("answer", "User Saved");
String json = new Gson().toJson(obj);
System.out.println("UserController.createUser " + json);
return ResponseEntity.accepted().body(json);
}
User user = new User(
null,
registerUser.getFirstName(),
registerUser.getLastName(),
registerUser.getEmail(),
passwordService.hashPassword(registerUser.getPassword(), salt),
salt
);
// build get user by id REST API
// http://localhost:8080/api/users/1
@CrossOrigin(origins = "${CROSS_ORIGIN}")
@GetMapping("{id}")
public ResponseEntity<User> getUserById(@PathVariable("id") Long userId) {
User user = userService.getUserById(userId);
return new ResponseEntity<>(user, HttpStatus.OK);
}
User savedUser = userService.createUser(user);
System.out.println("UserController.createUser, user saved in db");
JsonObject obj = new JsonObject();
obj.addProperty("answer", "User Saved");
String json = new Gson().toJson(obj);
System.out.println("UserController.createUser " + json);
return ResponseEntity.accepted().body(json);
}
// Build Get All Users REST API
// http://localhost:8080/api/users
@CrossOrigin(origins = "${CROSS_ORIGIN}")
@GetMapping
public ResponseEntity<List<User>> getAllUsers() {
List<User> users = userService.getAllUsers();
return new ResponseEntity<>(users, HttpStatus.OK);
}
// build get user by id REST API
// http://localhost:8080/api/users/1
@CrossOrigin(origins = "${CROSS_ORIGIN}")
@GetMapping("{id}")
public ResponseEntity<User> getUserById(@PathVariable("id") Long userId) {
User user = userService.getUserById(userId);
return new ResponseEntity<>(user, HttpStatus.OK);
}
// Build Update User REST API
// http://localhost:8080/api/users/1
@CrossOrigin(origins = "${CROSS_ORIGIN}")
@PutMapping("{id}")
public ResponseEntity<User> updateUser(@PathVariable("id") Long userId,
@RequestBody User user) {
user.setId(userId);
User updatedUser = userService.updateUser(user);
return new ResponseEntity<>(updatedUser, HttpStatus.OK);
}
// Build Get All Users REST API
// http://localhost:8080/api/users
@CrossOrigin(origins = "${CROSS_ORIGIN}")
@GetMapping
public ResponseEntity<List<User>> getAllUsers() {
List<User> users = userService.getAllUsers();
return new ResponseEntity<>(users, HttpStatus.OK);
}
// Build Delete User REST API
@CrossOrigin(origins = "${CROSS_ORIGIN}")
@DeleteMapping("{id}")
public ResponseEntity<String> deleteUser(@PathVariable("id") Long userId) {
userService.deleteUser(userId);
return new ResponseEntity<>("User successfully deleted!", HttpStatus.OK);
}
// Build Update User REST API
// http://localhost:8080/api/users/1
@CrossOrigin(origins = "${CROSS_ORIGIN}")
@PutMapping("{id}")
public ResponseEntity<User> updateUser(@PathVariable("id") Long userId,
@RequestBody User user) {
user.setId(userId);
User updatedUser = userService.updateUser(user);
return new ResponseEntity<>(updatedUser, HttpStatus.OK);
}
// Build Delete User REST API
@CrossOrigin(origins = "${CROSS_ORIGIN}")
@DeleteMapping("{id}")
public ResponseEntity<String> deleteUser(@PathVariable("id") Long userId) {
userService.deleteUser(userId);
return new ResponseEntity<>("User successfully deleted!", HttpStatus.OK);
}
// get user id by email
@CrossOrigin(origins = "${CROSS_ORIGIN}")
@PostMapping("/byemail")
public ResponseEntity<String> getUserIdByEmail(@RequestBody EmailAdress email, BindingResult bindingResult) {
System.out.println("UserController.getUserIdByEmail: " + email);
//input validation
if (bindingResult.hasErrors()) {
List<String> errors = bindingResult.getFieldErrors().stream()
.map(fieldError -> fieldError.getField() + ": " + fieldError.getDefaultMessage())
.collect(Collectors.toList());
System.out.println("UserController.createUser " + errors);
// get user id by email
@CrossOrigin(origins = "${CROSS_ORIGIN}")
@PostMapping("/byemail")
public ResponseEntity<String> getUserIdByEmail(@RequestBody EmailAdress email, BindingResult bindingResult) {
System.out.println("UserController.getUserIdByEmail: " + email);
//input validation
if (bindingResult.hasErrors()) {
List<String> errors = bindingResult.getFieldErrors().stream()
.map(fieldError -> fieldError.getField() + ": " + fieldError.getDefaultMessage())
.collect(Collectors.toList());
System.out.println("UserController.createUser " + errors);
JsonArray arr = new JsonArray();
errors.forEach(arr::add);
JsonObject obj = new JsonObject();
obj.add("message", arr);
String json = new Gson().toJson(obj);
JsonArray arr = new JsonArray();
errors.forEach(arr::add);
JsonObject obj = new JsonObject();
obj.add("message", arr);
String json = new Gson().toJson(obj);
System.out.println("UserController.createUser, validation fails: " + json);
return ResponseEntity.badRequest().body(json);
}
System.out.println("UserController.createUser, validation fails: " + json);
return ResponseEntity.badRequest().body(json);
}
System.out.println("UserController.getUserIdByEmail: input validation passed");
System.out.println("UserController.getUserIdByEmail: input validation passed");
User user = userService.findByEmail(email.getEmail());
if (user == null) {
System.out.println("UserController.getUserIdByEmail, no user found with email: " + email);
JsonObject obj = new JsonObject();
obj.addProperty("message", "No user found with this email");
String json = new Gson().toJson(obj);
User user = userService.findByEmail(email.getEmail());
if (user == null) {
System.out.println("UserController.getUserIdByEmail, no user found with email: " + email);
JsonObject obj = new JsonObject();
obj.addProperty("message", "No user found with this email");
String json = new Gson().toJson(obj);
System.out.println("UserController.getUserIdByEmail, fails: " + json);
return ResponseEntity.badRequest().body(json);
}
System.out.println("UserController.getUserIdByEmail, user find by email");
JsonObject obj = new JsonObject();
obj.addProperty("answer", user.getId());
String json = new Gson().toJson(obj);
System.out.println("UserController.getUserIdByEmail " + json);
return ResponseEntity.accepted().body(json);
}
System.out.println("UserController.getUserIdByEmail, fails: " + json);
return ResponseEntity.badRequest().body(json);
}
System.out.println("UserController.getUserIdByEmail, user find by email");
JsonObject obj = new JsonObject();
obj.addProperty("answer", user.getId());
String json = new Gson().toJson(obj);
System.out.println("UserController.getUserIdByEmail " + json);
return ResponseEntity.accepted().body(json);
}
}

3
183_12_1_tresorbackend_rupe-master/src/main/java/ch/bbw/pr/tresorbackend/model/User.java
View File

@ -32,4 +32,7 @@ public class User {
@Column(nullable = false)
private String password;
@Column(nullable = false)
private String salt;
}

32
183_12_1_tresorbackend_rupe-master/src/main/java/ch/bbw/pr/tresorbackend/service/PasswordEncryptionService.java
View File

@ -1,21 +1,37 @@
package ch.bbw.pr.tresorbackend.service;
import lombok.Value;
import org.bouncycastle.util.encoders.Hex;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.stereotype.Service;
import java.security.SecureRandom;
/**
* PasswordEncryptionService
*
* @author Peter Rutschmann
*/
@Service
public class PasswordEncryptionService {
//todo ergänzen!
public PasswordEncryptionService() {
//todo anpassen!
}
public PasswordEncryptionService() {
//todo anpassen!
}
public String hashPassword(String password) {
//todo anpassen!
return password;
}
public static String generateSalt() {
byte[] salt = new byte[5];
new SecureRandom().nextBytes(salt);
return Hex.toHexString(salt);
}
public String hashPassword(String password, String salt) {
BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
String pepper = new PepperService().getPepper();
return encoder.encode(pepper + password );
}
}
record PasswordBean(String hashedPassword, String Salt) {
}

19
183_12_1_tresorbackend_rupe-master/src/main/java/ch/bbw/pr/tresorbackend/service/PepperService.java Normal file
View File

@ -0,0 +1,19 @@
package ch.bbw.pr.tresorbackend.service;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;
@Component
public class PepperService {
@Value("${pepper}")
private String pepper;
public String getPepper() {
return pepper;
}
public void printPepper() {
System.out.println("Pepper value: " + pepper);
}
}

4
183_12_1_tresorbackend_rupe-master/src/main/resources/application.properties
View File

@ -8,4 +8,6 @@ spring.datasource.password=1234
spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.MySQLDialect
spring.jpa.hibernate.ddl-auto=update
CROSS_ORIGIN=http://localhost:3000
CROSS_ORIGIN=http://localhost:3000
pepper=VfQqM