1
0
mirror of synced 2026-08-04 17:27:13 +00:00

Remove unsafe/deprecated Encryptors.querableText(CharSequence,CharSequence)

This method is insecure. Users should instead encrypt with their database.

Closes gh-8980
This commit is contained in:
Rob Winch
2022-09-07 13:51:58 -05:00
parent 088ebe2e00
commit d996c2a2c6
4 changed files with 5 additions and 51 deletions
@@ -90,29 +90,6 @@ Encryptors.text("password", "salt")
A `TextEncryptor` uses a standard `BytesEncryptor` to encrypt text data.
Encrypted results are returned as hex-encoded strings for easy storage on the filesystem or in a database.
You can use the `Encryptors.queryableText` factory method to construct a "`queryable`" `TextEncryptor`:
.Queryable TextEncryptor
====
.Java
[source,java,role="primary"]
----
Encryptors.queryableText("password", "salt");
----
.Kotlin
[source,kotlin,role="secondary"]
----
Encryptors.queryableText("password", "salt")
----
====
The difference between a queryable `TextEncryptor` and a standard `TextEncryptor` has to do with initialization vector (IV) handling.
The IV used in a queryable `TextEncryptor.encrypt` operation is shared, or constant, and is not randomly generated.
This means the same text encrypted multiple times always produces the same encryption result.
This is less secure but necessary for encrypted data that needs to be queried against.
An example of queryable encrypted text would be an OAuth `apiKey`.
[[spring-security-crypto-keygenerators]]
== Key Generators
The {security-api-url}org/springframework/security/crypto/keygen/KeyGenerators.html[`KeyGenerators`] class provides a number of convenience factory methods for constructing different types of key generators.
+5
View File
@@ -3,3 +3,8 @@
Spring Security 6.0 provides a number of new features.
Below are the highlights of the release.
== Breaking Changes
* https://github.com/spring-projects/spring-security/issues/8980[gh-8980] - Remove unsafe/deprecated `Encryptors.querableText(CharSequence,CharSequence)`.
Instead use data storage to encrypt values.