title: How to programatically encrypt/decrypt plain text credentials in JSP?
body: <p>As as part of my daily routine, I have the misfortune of administering an ancient, once "just internal" JSP web application that relies on the following authentication schema:</p>
  
  <pre><code>...
  
  // Validate the user name and password.
  if ((user != null) &amp;&amp; (password != null) &amp;&amp; (
      (user.equals("brianmay") &amp;&amp; password.equals("queen")) ||
      (user.equals("rogertaylor") &amp;&amp; password.equals("queen")) ||
      (user.equals("freddiemercury") &amp;&amp; password.equals("queen")) ||
      (user.equals("johndeacon") &amp;&amp; password.equals("queen"))
     )) {
  // Store the user name as a session variable.
      session.putValue("user", user);
  
  ...
  </code></pre>
  
  <p>As much as I would like to, the Queen members have never been users of the system but anyway it does make a great example, does it not?</p>
  
  <p>Despite that by policy this client enforces security by domain authentication among other things, therefore this issue isn't seen as a security risk, still, my idea is to at least obfuscate that plain text credentials using perhaps a simple MD5 or SHA1 method, so such sensitive data is not visible to the naked eye.</p>
  
  <p>I'm a total newbie when it comes to JSP so I would really appreciate any piece of advice you'd be willing to share with me.</p>
  
  <p>Thanks much in advance!</p>