Package com.codename1.backend.security.crypto

package com.codename1.backend.security.crypto

Password hashing: the PasswordEncoder contract, the delegating encoder that reads the {id} in front of a stored password, and the encoders behind it.

Related Packages

Package	Description
com.codename1.backend.security	Authentication and authorization for the routes of a backend, in the shape of Spring Security: an application declares one or more SecurityFilterChain beans, each built from the HttpSecurity its method is handed, and every request the server does not answer on its own behalf is put to them.
com.codename1.backend.security.apikey	API keys: long-lived secrets a program presents instead of signing in.
com.codename1.backend.security.mfa	A second factor at sign-in: one-time codes from an authenticator app, and the recovery codes that stand in for a lost phone.
com.codename1.backend.security.ratelimit	Limits on how often a client may ask: a RateLimiter counts requests under a key, and a RateLimitKeyResolver says which key a request counts under -- its client's address, who it is signed in as, its session, its API key.
com.codename1.backend.security.rememberme	Remember-me: recognizing a returning user by a cookie, so that closing the browser does not sign them out.
com.codename1.backend.security.webauthn	Passkeys: signing in with a credential an authenticator holds, as the Web Authentication specification defines it.

Class	Description
BCryptPasswordEncoder	bcrypt, as OpenBSD defined it and Spring's BCryptPasswordEncoder writes it: $2a$, $2b$ or $2y$, a cost, a 16 byte salt and a 23 byte hash.
DelegatingPasswordEncoder	Reads which scheme a stored password was made with from the {id} in front of it, so one user store can hold passwords of several ages:
Der	The little ASN.1 DER a server needs to move keys and signatures between the shapes they travel in: a JSON Web Key's numbers and the SubjectPublicKeyInfo that Crypto.verify(String, byte[], byte[], byte[]) takes; a PKCS#1 or SEC 1 private key out of an older PEM file and the PKCS#8 that Crypto.sign(String, byte[], byte[]) takes; an ECDSA signature as OpenSSL and the JDK write it and as a JSON Web Signature carries it.
Jwk	One key, as a JSON Web Key describes it (RFC 7517): an RSA key, an EC key on P-256 or P-384, or a shared secret.
JwkSet	A set of keys, as a JSON Web Key Set publishes one (RFC 7517 5): what a server that signs tokens serves at its jwks_uri, and what a server that verifies them reads from there.
JwkSource	Where keys come from: a set held in memory, a file read at start-up, another server's published set.
KeyFiles	Reads keys out of PEM text, in the shapes key files come in, and hands back the one shape the runtime signs and verifies with: PKCS#8 DER for a private key, SubjectPublicKeyInfo DER for a public one.
NoOpPasswordEncoder	Stores a password as it is: {noop}secret.
PasswordEncoder	Turns a password into what is stored, and checks a password against it.
PasswordEncoderFactories	Makes the PasswordEncoder an application should use unless it has a reason to choose its own.
Pbkdf2PasswordEncoder	Reads the PBKDF2 passwords Spring Security's Pbkdf2PasswordEncoder wrote, so a user table brought over from a Spring application signs its users in as it is.
Pbkdf2Sha256PasswordEncoder	PBKDF2-HMAC-SHA256 through the runtime's own Crypto.hashPassword(String) and Crypto.verifyPassword(String, String): a random salt per password, and the round count written into the result, so a stored value says how it is to be checked.
SignedTokens	Makes and checks the tokens a server mails out: the link that confirms an address, the link that resets a password, an invitation.