java - How do I configure REST service to manually check encrypted passwords with Spring Security? -

a restful spring boot service needs manually login users credentials sent via json angularjs front end. code below accomplishes using unencrypted passwords, want passwords encrypted when stored in database. when add bcryptpasswordencoder().matches... code below, still not able match encrypted user password. what specific changes need made code below /login1 method able perform manual password checking , able perform custom login procedures?

here 4 lines of login process failing password match currently, though failure may due way passwords encrypted in registration process:

userdetails user = users.loaduserbyusername(uname); passwordencoder encoder = new bcryptpasswordencoder(); string encpwd = encoder.encode(rphon.getencpwd());//takes json unencoded string value `password` , encodes using encoder.encode(...) if(encoder.matches(user.getpassword(), encpwd)){//this encoder.matches check fails   

here complete relevant code 2 rest services in spring boot app handle registration (password encryption) , authentication (password matching), respectively. note in present configuration, client app sending password value password in unencrypted text, through ssl connection:

@requestmapping(value = "/register", method = requestmethod.post) public @responsebody resultmessage getpin(@requestbody resultmessage rmsg) {      string uname = rmsg.getname(); weblead wld = myrepo.findbyemailaddress(uname);     user newusr = new user();     newusr.setname(wld.getemailaddress());     passwordencoder encoder = new bcryptpasswordencoder();     string pwd = encoder.encode("password");     newusr.setpassword(pwd);     users.createuser(newusr); // bunch of unrelated code     return something; }  @requestmapping(value = "/login1", method = requestmethod.post) public @responsebody resultmessage login1(httpsession session, httpservletresponse response, @requestbody resultmessage rphon) {     resultmessage resmess = new resultmessage(); string uname = rphon.getname(); resmess.setname(uname); userdetails user = users.loaduserbyusername(uname); passwordencoder encoder = new bcryptpasswordencoder(); string encpwd = encoder.encode(rphon.getencpwd());//takes json unencoded string value `password` , encodes using encoder.encode(...) if(encoder.matches(user.getpassword(), encpwd)){     list<grantedauthority> auth = authorityutils.commaseparatedstringtoauthoritylist("role_user");     authentication authentication = new usernamepasswordauthenticationtoken(user, null, auth);     securitycontextholder.getcontext().setauthentication(authentication);     response.addcookie(new cookie("auth", "yes")); }     return resmess; }  

here relevant parts of spring security config:

@suppresswarnings("deprecation") @configuration @order(securityproperties.access_override_order) @enablewebmvcsecurity @enableglobalmethodsecurity(prepostenabled = true) protected static class securityconfiguration extends websecurityconfigureradapter {      @override     protected void configure(httpsecurity http) throws exception {         http             .formlogin()                 .successhandler(new myauthenticationsuccesshandler())                 .and()             .httpbasic().and()             .authorizerequests()                 .antmatchers("/register").permitall()                 .antmatchers("/login1").permitall()                 .antmatchers("/index.html", "/", "/gui_route_1", "/gui_route_2", "/gui_route_n").permitall()                 .anyrequest().authenticated()                 .and()             .csrf()                 .csrftokenrepository(csrftokenrepository())                 .and()             .addfilterafter(csrfheaderfilter(), csrffilter.class);     }  } 

the interface passwordencoder has method defined below.

boolean matches(charsequence rawpassword,           string encodedpassword) 

verify encoded password obtained storage matches submitted raw password after encoded. returns true if passwords match, false if not. stored password never decoded.

parameters:

• rawpassword - raw password encode , match
• encodedpassword - encoded password storage compare with

returns:

• true if raw password, after encoding, matches encoded password storage

it expecting passed raw password(either json has raw or may have decode based on how encoded, convert raw) first parameter , encoded password comes db second parameter.