JavaIsJavaScript
diff --git a/‎src/main/java/de/rwth/idsg/steve/SteveConfiguration.java‎
Lines changed: 8 additions & 2 deletions b/‎src/main/java/de/rwth/idsg/steve/SteveConfiguration.java‎
Lines changed: 8 additions & 2 deletions
diff --git a/‎src/main/java/de/rwth/idsg/steve/config/SecurityConfiguration.java‎
Lines changed: 2 additions & 4 deletions b/‎src/main/java/de/rwth/idsg/steve/config/SecurityConfiguration.java‎
Lines changed: 2 additions & 4 deletions
@@ -5,6 +5,8 @@
 import de.rwth.idsg.steve.utils.PropertiesFileLoader;
 import lombok.Builder;
 import lombok.Getter;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
 
 /**
  * @author Sevket Goekay <goekay@dbis.rwth-aachen.de>
@@ -66,9 +68,12 @@ public enum SteveConfiguration {
                .sqlLogging(p.getBoolean("db.sql.logging"))
                .build();
 
+        PasswordEncoder encoder = new BCryptPasswordEncoder();
+
         auth = Auth.builder()
+                   .passwordEncoder(encoder)
                    .userName(p.getString("auth.user"))
-                   .password(p.getString("auth.password"))
+                   .encodedPassword(encoder.encode(p.getString("auth.password")))
                    .build();
 
         ocpp = Ocpp.builder()
@@ -154,8 +159,9 @@ public static class DB {
     // Credentials for Web interface access
     @Builder @Getter
     public static class Auth {
+        private final PasswordEncoder passwordEncoder;
         private final String userName;
-        private final String password;
+        private final String encodedPassword;
     }
 
     // OCPP-related configuration
 
@@ -27,18 +27,16 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
     /**
      * Password encoding changed with spring-security 5.0.0. We either have to use a prefix before the password to
      * indicate which actual encoder {@link DelegatingPasswordEncoder} should use [1, 2] or specify the encoder as we do.
-     * {@link NoOpPasswordEncoder} is deprecated because it is not secure since it is not a one way hash function and
-     * uses plain text matching, but is good enough for our simple user management and login authorization case.
      *
      * [1] https://spring.io/blog/2017/11/01/spring-security-5-0-0-rc1-released#password-storage-format
      * [2] {@link PasswordEncoderFactories#createDelegatingPasswordEncoder()}
      */
     @Autowired
     public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
         auth.inMemoryAuthentication()
-            .passwordEncoder(NoOpPasswordEncoder.getInstance())
+            .passwordEncoder(CONFIG.getAuth().getPasswordEncoder())
             .withUser(CONFIG.getAuth().getUserName())
-            .password(CONFIG.getAuth().getPassword())
+            .password(CONFIG.getAuth().getEncodedPassword())
             .roles("ADMIN");
     }