相关疑难解决方法(0)

好的,我想了解使用盐的原因.

当用户注册时,我为他/她生成一个我存储在DB中的唯一盐.然后我用SHA1散列它和密码.当他/她登录时我会重新哈希sha1($salt.$password).

但如果有人攻击我的数据库,他可以看到哈希密码和盐.

是否更难破解而不仅仅是用盐哈希密码？我不明白......

对不起,如果我是傻瓜......

我在我的应用程序中使用Spring MVC,登录通过spring security进行身份验证.我的类中有以下两种方法UserServiceImpl.java,public UserDetails loadUserByUsername(String userName)抛出UsernameNotFoundException,DataAccessException {

        ApplicationTO applicationTO = null;
        try
            {
                applicationTO = applicationService.getApplicationTO(adminDomainName);
            }
        catch (ApplicationPropertyException e)
            {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
        UserTO userTO = getUserTO(applicationTO.getApplicationId(), userName);
        if (userTO == null)
            {
                throw new UsernameNotFoundException("user not found");
            }
        httpSession.setAttribute("userTO", userTO);
        return buildUserFromUserEntity(userTO);
    }


User buildUserFromUserEntity(UserTO userTO)
            {
                String username = userTO.getUsername();
                String password = userTO.getPassword();
                int userId = userTO.getUserId();
                int applicationId = userTO.getApplicationId();
                boolean enabled = userTO.isEnabled();
                boolean accountNonExpired = true;
                boolean …