-
Type:
Bug
-
Status: Closed
-
Priority:
Major
-
Resolution: Not A Problem
-
Affects Version/s: 1.1.0
-
Fix Version/s: 1.1.0
-
Component/s: Authorization (access control) , Cryptography & Hashing
-
Labels:None
-
Environment:irrelevant
isStoredCredentialsHexEncoded() always returns true, no matter if I store a hex or a base64 password or credential. Hex is Base16. Authentication fails if I store Base64 with an IllegalArgumentException because Hex.decode(...) doesn't recognize but the 0..9 and a..f alphabet
Code quote:
//account.credentials were a char[] or String, so
//we need to do text decoding first:
if (isStoredCredentialsHexEncoded())
else
{ storedBytes = Base64.decode(storedBytes); }...
from my ini:
- password hashing specification
sha256Matcher = org.apache.shiro.authc.credential.HashedCredentialsMatcher
sha256Matcher.hashAlgorithmName=SHA-256