The previous videos we looked at what is encoding encryption, hasheem and hotspring security can leverage
them using a password.
And so I have been saying that password encoded is the responsible intercepting security, which can
be violating the password by leveraging the harshing encryption or encoding, whatever you say to it.
But let's try to look into it.
What exactly?
Percent inside password and a definition.
So when is a password?
And it is an interface available in such security and it has primarily three methods.
One is the very first one which we call letters and code, which acceptor a password from the user to
without using the word encode.
That doesn't mean this applicable only for encoding, but not for encryption.
And so here it took as a general term.
Encoding means converting from one form to another form and thereby using encoding algorithms or encryption
or hash items.
So the purpose of this method is who are implementing this method?
They should accept the real password, which is coming from the framework, and they have to encode
it as part of the requirement.
Suppose things like I use to use some cash, get them to use inside my application so that no one can
ever it or decoded to see the original text.
So this method will be called by spring security framework as soon as it receives a Crenshaw's from
the user and it will try to generate a hash out of it by taking the original text.
So once we have that hashed password, then spring security leverages matches method.
So Matches Matter is the place where our spring security first try to call our encode method by passing
the password and in return it will get the hash value of the text that we received from the user.
And at the same time it also accept another parameter which is encoded password, which we already shared
inside the database.
So it will take both the hash values and try to compare.
If it matches, it will return a boolean.
True, otherwise false.
So based upon this method, framework will decide whether I should authenticate the person or not.
And at last we also have one implementation method, which is a great encoding.
So by default, this return false.
The purpose of this method is suppose you want to make your hashing algorithm or encoding or encryption
algorithm to make it even more complex for the users to decode it.
So that's where you will mention a great encoding as true, which means spring security will try to
do encoding on top of existing encoding.
That means you will be doing that encoding, encryption or hashing two times, which gives you more
security.
But that doesn't mean you should always use this method by ordering it to true, because sometimes trying
to encoding the same string multiple times will slow down your process because hashing encryption,
they all took some good amount of time and processing time.
So that's where if you're trying to make it even more complex, so then you should be in a position
where you don't have any issues that taking more time compared to what you essentially have for a single
encoding.
So this is a sample interface provided by spring security.
And at the same time, spring security also provides different flavors of passwords and codes that we
can leverage inside our application based upon our requirements.
You're always free to go and implement this password in order, and you can build your own logic.
Inside this code matches Materne as part of our algorithms as per application requirements.
But to help you to get started, we have five different password encoders provided by spring security,
which is no password encoded, which we already using previously, and next to standard password and
encoder, followed by Ebiquity to Password Encoder Biggera Password and and password.
And I would say most of the application there should be good if they can leverage this existing password
encoders that's being security code.
The reason is they are already following enough algorithms on security measures that no one can decode
your password.
And you can see most of our industry applications, they are using Bakry password encoded, which is
the.
Famous one in the industry, that's where will do some hands on with the secret password encoded in
the coming videos.
So now we have a basic understanding of what is password encoded.
Let's try to deepti each of these password encoders and try to do some handson with the password encoded
in the coming videos.
Thank you.
And by.