In this video, let's try to understand how our passports will be validated by spring security by default.
So this is a diagram that you can try to understand.
First, the user and his credentials, like admin's my user name and one, two, three, four is my
password.
As soon as the user enter login, spring takes the user name and call load by user name to the database,
and it will try to get all the user details, including the password.
Once it receives the passwords from the database, it will try to compare what is a password that I
have received from the user and is it the same or is it equal in the database as well?
If both are matches, it will allow further processing of the request.
If not, it will through and for zero one unauthorized error which indicate login felt.
This approach may look good for us, but it has a lot of issues since.
The very first issue that I can see is you are storing user details like password, which is a very
sensitive data inside your database without any encryption encoding or hash.
So that means you may say, like my website has thousands of users and millions of users and I am storing
all their credentials inside my database table and no one can access the table except the application.
But still, there might be certain people who can access the table, whatever restrictions that you
can put, like your DBS can see the passwords inside your table because you're storing them in plain
text and anyone can see my credentials and they can log into my bank application and they can perform
whatever operations they need because they know my username and password.
That's one issue.
The other issue is you are sending passwords in plain text or the network, like from my client browser
to your server back.
And so that means you are exposing the most sensitive data inside your application, which is password
or the network, which result in two types of issues.
One is integrity issues where your database administrators can look into the passwords and confidentiality.
Your application is not maintained confidentiality and it is taking the password in plain text and it
is communicating with the network, using the plain text.
If someone tried to intercept my request, they can see what is my password without any effort.
So this is the default behavior provided by spring security and this is no harm following it.
If your application is only specific to lawyer environments like development, safety and security environment,
or your application does not have any valuable information storing inside it, and even your customers
are fine if someone knows the password.
So only in such scenarios should follow this method.
But we can always say 99 percent of our applications will not need this approach because it lacks a
lot of security measures and it clearly exposes your passwords like anything to your database administrators
or to the network.
So to avoid this, we should try to encrypt or hash your password, or maybe if your application is
small enough where you are, users are fine to lost the password.
At least you should try to encode your password.
So we're speaking here a lot about encoding, hashing, encryption, but what's the difference between
the what scenario, how to use them?
So let's try to look in detail one by one about them in the next.
We thank you and.