title: Java - Spring - Basic authentication - How to hash the password defined in application.properties
body: <p>Iam implementing a basic authentication for Spring Boot application and iam defining my credentials in application.properties class but I want to hash-encode the password and then check if the hash is the same as the hash for the password in application.properties then I can login. If possible to do all of the logic in the <strong>configure method</strong> then it would be great.</p>
  
  <p><strong>application.properties:</strong></p>
  
  <h1>BASIC AUTHENTICATION</h1>
  
  <pre><code>user.name=test
  user.password={noop}example
  </code></pre>
  
  <p><strong>SecurityConfig class:</strong></p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      private static final Logger logger = LoggerFactory.getLogger(SecurityConfig.class);
  
      private AuthenticationProvider authenticationProvider;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http.csrf().disable().authorizeRequests().anyRequest().authenticated().and().httpBasic()
                  .and().sessionManagement().and().authenticationProvider(authenticationProvider)
                  .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
      }
  </code></pre>
  
  <p><strong><em>UPDATED CODE</em></strong></p>
  
  <pre><code>import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  import org.springframework.beans.factory.annotation.Value;
  import org.springframework.context.annotation.Bean;
  import org.springframework.context.annotation.Configuration;
  import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  import org.springframework.security.config.http.SessionCreationPolicy;
  import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  import org.springframework.security.crypto.password.PasswordEncoder;
  @Configuration
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      private static final Logger logger = LoggerFactory.getLogger(SecurityConfig.class);
  
      @Value("${security.user.password}")
      private String password;
      @Value("${security.user.name}")
      private String username;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http.csrf().disable().authorizeRequests().anyRequest().authenticated()
                  .and().logout().and().httpBasic().and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
  
  
      }
  
      @Override
      public void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.inMemoryAuthentication().
                  passwordEncoder(passwordEncoder()).withUser(username).password(password);
      }
  
      @Bean
      public PasswordEncoder passwordEncoder() {
          return new BCryptPasswordEncoder();
      }
  
      @Bean
      public String generateHashedPassword(String password) {
          return BCrypt.hashpw(password, BCrypt.gensalt(10));
      }
  }
  </code></pre>
  
  <p><strong>UPDATE 2</strong></p>
  
  <p>Currently the way it works now is when i start the application, i visit localhost:8080 then a login popup appears and i type the username and password (that are defined in application.properties) </p>
  
  <p>if I type the right username and password i get logged in but if i manage to login with the username and password defined in application.properties then whats the point with hashing the password? I was thinking more like having a list of hashed keys and compare the input password with the list and if success then login.</p>