How to programatically encrypt/decrypt plain text credentials in JSP?

Question

As as part of my daily routine, I have the misfortune of administering an ancient, once "just internal" JSP web application that relies on the following authentication schema:

...

// Validate the user name and password.
if ((user != null) && (password != null) && (
    (user.equals("brianmay") && password.equals("queen")) ||
    (user.equals("rogertaylor") && password.equals("queen")) ||
    (user.equals("freddiemercury") && password.equals("queen")) ||
    (user.equals("johndeacon") && password.equals("queen"))
   )) {
// Store the user name as a session variable.
    session.putValue("user", user);

...

As much as I would like to, the Queen members have never been users of the system but anyway it does make a great example, does it not?

Despite that by policy this client enforces security by domain authentication among other things, therefore this issue isn't seen as a security risk, still, my idea is to at least obfuscate that plain text credentials using perhaps a simple MD5 or SHA1 method, so such sensitive data is not visible to the naked eye.

I'm a total newbie when it comes to JSP so I would really appreciate any piece of advice you'd be willing to share with me.

Thanks much in advance!

Answer 1

First of all you should move that logic from jsp to a separate class.

Second, you shouldn't keep plain text password anywhere in the code. Use some kind of one way hash function (md5, sha1, ...) and keep only password hashes.

When checking for user password, first hash it and then compare hashes.

Answer 2

It is hard to understand the exact scheme you are thinking about but I assume the password is coming in from a request and you want to calculate the MD5 hash in a JSP that the request is being sent to. After that you can compare it to the pre-computed MD5 version. You could even be more secure if it isn't being done with https and use a javascript MD5 library to hash the password before submitting it.

You can MD5 a string in java like this:

try
{
  String digestInput = "queen";

  MessageDigest messageDigest = MessageDigest.getInstance("MD5");
  messageDigest.update(digestInput.getBytes());

  BASE64Encoder base64Encoder = new BASE64Encoder();
  String digestString = base64Encoder.encode(messageDigest.digest());

  // digestString now contains the md5 hashed password
}
catch (Exception e)
{
  // do some type of logging here
}

Answer 3

Good Day:

based on the previous example Could you please let me know how to decode or decrypt digestString ??? In order to get the word "queen" Thanks in Advance