Spring Security >5.0.0 removed Md5PasswordEncoder

Question

I have a Spring project using Spring security. I was using Spring Boot 1.5 and now I migrated to Spring Boot 2.0.

I noticed that Md5PasswordEncoder has been removed in the final release of Spring Security. Instead Md4PasswordEncoder is still present even if deprecated (https://docs.spring.io/spring-security/site/docs/5.0.3.RELEASE/api/).

Should I use extenal MD5 encoder or is the classed moved somewhere else?

Answer 1

The fact that Md5PasswordEncoder ceased to exist doesn't mean that Spring Security 5 isn't able to create MD5 hashes. It uses new MessageDigestPasswordEncoder("MD5") for that.

There are two options, both work with the new DelegatingPasswordEncoder, which expects a password prefix to determine the hashing algorithm, for example {MD5}password_hash:

Either set the default password encoder to MD5 (in uppercase!), so if passwords aren't prefixed, then the default encoder is applied:

PasswordEncoder passwordEncoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();
passwordEncoder.setDefaultPasswordEncoderForMatches(new MessageDigestPasswordEncoder("MD5"));

Or prefix the existing password hashes in the database with {MD5}. This way the DelegatingPasswordEncoder delegates to the `MD5' hasher. Something like:

update myusertable set pwd = '{MD5}' || pwd;