我有一个passwordencryptionservice,在那里我散列我的密码,并将它们与散列密码所用的salt一起保存在mysql数据库中。我将我的密码和salt都保存为字节数组,我听说我可以将它们保存为sql数据库中的varbinary类型。
这是我的代码:
//this method is used to retrieve the salt when a user is logging in
public static byte[] getSaltMethod(String username, String password) throws SQLException, LoginSampleException {
try {
Connection con = Connector.connection();
String SQL = "SELECT * from Users.Salt WHERE email = ?, password = ?";
PreparedStatement statement = con.prepareStatement(SQL);
statement.setString(1, username);
statement.setString(2, password);
ResultSet set = statement.executeQuery();
while (set.next()) {
// vi skal ikke have en blolb her alligevel
byte[] salt = set.getBytes("salt");
//release the blob and free up memory. (since JDBC 4.0)
/* jeg er i tivil om denne skal være her*/
return salt;
}
} catch (SQLException ex) {
Conf.MYLOGGER.log(Level.SEVERE, null, ex);
throw new LoginSampleException(ex.getSQLState());
}
return null;
}
//this method is used to save the user along with the salt when a user is signing up
public static void createUser(User user) throws LoginSampleException, NoSuchAlgorithmException
{
try {
PasswordEncryptionService PE = new PasswordEncryptionService();
byte[] salt = PE.generateSalt();
Connection con = Connector.connection();
String SQL = "INSERT INTO Users (email, password, phone, post, adress, role, salt) VALUES (?, ?, ?, ?, ?, ?, ?)";
PreparedStatement ps = con.prepareStatement(SQL, Statement.RETURN_GENERATED_KEYS);
ps.setString(1, user.getEmail());
ps.setString(2, user.getPassword());
ps.setString(3, user.getPhonenumber());
ps.setString(4, user.getPostalCode());
ps.setString(5, user.getAddress());
ps.setString(6, user.getRole());
ps.setBytes(7, salt);
ps.executeUpdate();
ResultSet ids = ps.getGeneratedKeys();
ids.next();
int id = ids.getInt(1);
user.setId(id);
} catch (SQLException ex) {
throw new LoginSampleException(ex.getMessage());
}
}
现在我有一个单独的方法来检索salt,并登录person,我应该将salt保存在另一个表中,还是可以保存在user对象中?我应该将它保存为varbinary还是只保存为普通的varchar?
