[Spring Boot Basics] Xác thực người dùng từ database với Spring Security: UserDetailsService, BCrypt, đăng ký và đăng nhập

package com.example.demo.user;
 
public enum Role {
    USER, ADMIN
}

package com.example.demo.user;
 
import jakarta.persistence.Column;
import jakarta.persistence.Entity;
import jakarta.persistence.EnumType;
import jakarta.persistence.Enumerated;
import jakarta.persistence.GeneratedValue;
import jakarta.persistence.GenerationType;
import jakarta.persistence.Id;
import jakarta.persistence.Table;
 
@Entity
@Table(name = "users")
public class AppUser {
 
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
 
    @Column(nullable = false, length = 50, unique = true)
    private String username;
 
    @Column(nullable = false, length = 254, unique = true)
    private String email;
 
    @Column(nullable = false, length = 100)
    private String passwordHash;
 
    @Enumerated(EnumType.STRING)
    @Column(nullable = false, length = 20)
    private Role role = Role.USER;
 
    private boolean enabled = true;
 
    protected AppUser() {
    }
 
    public AppUser(String username, String email, String passwordHash) {
        this.username = username;
        this.email = email;
        this.passwordHash = passwordHash;
    }
 
    public Long getId() { return id; }
 
    public String getUsername() { return username; }
 
    public String getEmail() { return email; }
 
    public String getPasswordHash() { return passwordHash; }
    public void setPasswordHash(String passwordHash) { this.passwordHash = passwordHash; }
 
    public Role getRole() { return role; }
 
    public boolean isEnabled() { return enabled; }
    public void setEnabled(boolean enabled) { this.enabled = enabled; }
 
    @Override
    public boolean equals(Object o) {
        if (this == o) return true;
        if (!(o instanceof AppUser other)) return false;
        return id != null && id.equals(other.getId());
    }
 
    @Override
    public int hashCode() {
        return AppUser.class.hashCode();
    }
}

package com.example.demo.user;
 
import java.util.Optional;
 
import org.springframework.data.jpa.repository.JpaRepository;
 
public interface AppUserRepository extends JpaRepository<AppUser, Long> {
 
    Optional<AppUser> findByUsername(String username);
 
    boolean existsByUsername(String username);
 
    boolean existsByEmail(String email);
}

docker run -d --name sb-a34-pg -e POSTGRES_USER=demo -e POSTGRES_PASSWORD=secret -e POSTGRES_DB=demo -p 55434:5432 postgres:18

spring.datasource.url=jdbc:postgresql://localhost:55434/demo
spring.datasource.username=demo
spring.datasource.password=secret

java -jar build/libs/demo-0.0.1-SNAPSHOT.jar --server.port=8134 --spring.profiles.active=postgres --spring.jpa.hibernate.ddl-auto=update

SQL: create table users (id bigint generated by default as identity, email varchar(254) not null, enabled boolean not null, password_hash varchar(100) not null, role varchar(20) not null check ((role in ('USER','ADMIN'))), username varchar(50) not null, primary key (id))
SQL: alter table if exists users drop constraint if exists UK6dotkott2kjsp8vw4d0m25fb7
SQL: alter table if exists users add constraint UK6dotkott2kjsp8vw4d0m25fb7 unique (email)
SQL: alter table if exists users drop constraint if exists UKr43af9ap4edm43mmtq01oddj6
SQL: alter table if exists users add constraint UKr43af9ap4edm43mmtq01oddj6 unique (username)

docker exec sb-a34-pg psql -U demo -d demo -c '\d users'

                                       Table "public.users"
    Column     |          Type          | Collation | Nullable |             Default
---------------+------------------------+-----------+----------+----------------------------------
 id            | bigint                 |           | not null | generated by default as identity
 email         | character varying(254) |           | not null |
 enabled       | boolean                |           | not null |
 password_hash | character varying(100) |           | not null |
 role          | character varying(20)  |           | not null |
 username      | character varying(50)  |           | not null |
Indexes:
    "users_pkey" PRIMARY KEY, btree (id)
    "uk6dotkott2kjsp8vw4d0m25fb7" UNIQUE CONSTRAINT, btree (email)
    "ukr43af9ap4edm43mmtq01oddj6" UNIQUE CONSTRAINT, btree (username)
Check constraints:
    "users_role_check" CHECK (role::text = ANY (ARRAY['USER'::character varying, 'ADMIN'::character varying]::text[]))

package com.example.demo.user;
 
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsPasswordService;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
 
@Service
public class JpaUserDetailsService implements UserDetailsService, UserDetailsPasswordService {
 
    private final AppUserRepository repository;
 
    public JpaUserDetailsService(AppUserRepository repository) {
        this.repository = repository;
    }
 
    @Override
    public UserDetails loadUserByUsername(String username) {
        AppUser user = repository.findByUsername(username)
                .orElseThrow(() -> new UsernameNotFoundException("No user named " + username));
        return User.withUsername(user.getUsername())
                .password(user.getPasswordHash())
                .roles(user.getRole().name())
                .disabled(!user.isEnabled())
                .build();
    }
 
    @Override
    @Transactional
    public UserDetails updatePassword(UserDetails user, String newPassword) {
        AppUser appUser = repository.findByUsername(user.getUsername()).orElseThrow();
        appUser.setPasswordHash(newPassword);
        return User.withUserDetails(user).password(newPassword).build();
    }
}

import org.springframework.security.core.userdetails.User; 
import org.springframework.security.core.userdetails.UserDetails; 
import org.springframework.security.provisioning.InMemoryUserDetailsManager; 
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; 
import org.springframework.security.crypto.password.PasswordEncoder; 
 
@Configuration
public class SecurityConfig {
 
    // apiSecurityFilterChain and webSecurityFilterChain are unchanged from article 33
 
    @Bean
    InMemoryUserDetailsManager userDetailsService() { 
        UserDetails alice = User.withUsername("alice") 
                .password("{noop}alice-secret") 
                .roles("USER") 
                .build(); 
        UserDetails bob = User.withUsername("bob") 
                .password("{noop}bob-secret") 
                .roles("USER", "ADMIN") 
                .build(); 
        return new InMemoryUserDetailsManager(alice, bob); 
    } 
    @Bean
    PasswordEncoder passwordEncoder() { 
        return new BCryptPasswordEncoder(); 
    } 
}

2026-09-14T11:13:13.959+07:00  WARN 50769 --- [demo] [           main] .s.a.UserDetailsServiceAutoConfiguration :
 
Using generated security password: 6e956b91-b29d-43c4-addf-0ed8a2c4d1ef
 
This generated password is for development use only. Your security configuration must be updated before running your application in production.
 
2026-09-14T11:13:13.973+07:00  INFO 50769 --- [demo] [           main] r$InitializeUserDetailsManagerConfigurer : Global AuthenticationManager configured with UserDetailsService bean with name inMemoryUserDetailsManager

2026-09-14T11:17:25.055+07:00  INFO 51765 --- [demo] [           main] r$InitializeUserDetailsManagerConfigurer : Global AuthenticationManager configured with UserDetailsService bean with name jpaUserDetailsService

   UserDetailsServiceAutoConfiguration:
      Did not match:
         - @ConditionalOnMissingBean (types: org.springframework.security.authentication.AuthenticationManager,org.springframework.security.authentication.AuthenticationProvider,org.springframework.security.core.userdetails.UserDetailsService,org.springframework.security.authentication.AuthenticationManagerResolver,org.springframework.security.oauth2.jwt.JwtDecoder; SearchStrategy: all) found beans of type 'org.springframework.security.authentication.AuthenticationManager' authenticationManager and found beans of type 'org.springframework.security.core.userdetails.UserDetailsService' jpaUserDetailsService (OnBeanCondition)

package com.example.demo.lab;
 
import java.lang.reflect.Field;
 
import org.springframework.boot.CommandLineRunner;
import org.springframework.context.annotation.Profile;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.ProviderManager;
import org.springframework.security.web.FilterChainProxy;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
import org.springframework.stereotype.Component;
 
import jakarta.servlet.Filter;
 
@Component
@Profile("inspect")
class AuthManagerInspector implements CommandLineRunner {
 
    private final AuthenticationManager authenticationManager;
    private final FilterChainProxy filterChainProxy;
    private final org.springframework.security.crypto.password.PasswordEncoder passwordEncoder;
 
    AuthManagerInspector(AuthenticationManager authenticationManager, FilterChainProxy filterChainProxy,
            org.springframework.security.crypto.password.PasswordEncoder passwordEncoder) {
        this.authenticationManager = authenticationManager;
        this.filterChainProxy = filterChainProxy;
        this.passwordEncoder = passwordEncoder;
    }
 
    @Override
    public void run(String... args) throws Exception {
        System.out.println("PasswordEncoder bean: " + passwordEncoder.getClass().getName() + "@" + Integer.toHexString(System.identityHashCode(passwordEncoder)));
        System.out.println("AuthenticationManager bean: " + describe(authenticationManager, ""));
        for (var chain : filterChainProxy.getFilterChains()) {
            for (Filter filter : chain.getFilters()) {
                if (filter instanceof BasicAuthenticationFilter basic) {
                    Object manager = read(basic, BasicAuthenticationFilter.class, "authenticationManager");
                    System.out.println("BasicAuthenticationFilter uses: " + describe(manager, ""));
                    System.out.println("same instance as the bean: " + (manager == authenticationManager));
                }
            }
        }
    }
 
    private String describe(Object manager, String indent) throws Exception {
        StringBuilder sb = new StringBuilder(manager.getClass().getName() + "@" + Integer.toHexString(System.identityHashCode(manager)));
        if (manager instanceof ProviderManager pm) {
            for (AuthenticationProvider provider : pm.getProviders()) {
                sb.append("\n").append(indent).append("  provider: ").append(provider.getClass().getName());
                for (Class<?> c = provider.getClass(); c != Object.class; c = c.getSuperclass()) {
                    for (Field f : c.getDeclaredFields()) {
                        if (java.lang.reflect.Modifier.isStatic(f.getModifiers())) continue;
                        f.setAccessible(true);
                        Object v = f.get(provider);
                        String shown = v == null ? "null" : (v instanceof Boolean || v instanceof String) ? v.toString()
                                : (v instanceof java.util.function.Supplier<?> s) ? "Supplier of " + s.get().getClass().getName() + "@" + Integer.toHexString(System.identityHashCode(s.get()))
                                : v.getClass().getName();
                        sb.append("\n").append(indent).append("    ").append(c.getSimpleName()).append(".").append(f.getName()).append(" = ").append(shown);
                    }
                }
            }
            Object parent = read(pm, ProviderManager.class, "parent");
            sb.append("\n").append(indent).append("  eraseCredentialsAfterAuthentication = ").append(read(pm, ProviderManager.class, "eraseCredentialsAfterAuthentication"));
            sb.append("\n").append(indent).append("  parent: ").append(parent == null ? "null" : describe(parent, indent + "  "));
        }
        return sb.toString();
    }
 
    private static Object read(Object target, Class<?> type, String name) throws Exception {
        Field f = type.getDeclaredField(name);
        f.setAccessible(true);
        return f.get(target);
    }
}

java -jar build/libs/demo-0.0.1-SNAPSHOT.jar --server.port=8134 --spring.profiles.active=postgres,inspect --spring.jpa.hibernate.ddl-auto=update

PasswordEncoder bean: org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder@2738a1fc
AuthenticationManager bean: org.springframework.security.authentication.ProviderManager@5e0602ff
  provider: org.springframework.security.authentication.dao.DaoAuthenticationProvider
    DaoAuthenticationProvider.passwordEncoder = Supplier of org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder@2738a1fc
    DaoAuthenticationProvider.userNotFoundEncodedPassword = null
    DaoAuthenticationProvider.userDetailsService = com.example.demo.user.JpaUserDetailsService$$SpringCGLIB$$0
    DaoAuthenticationProvider.userDetailsPasswordService = com.example.demo.user.JpaUserDetailsService$$SpringCGLIB$$0
    DaoAuthenticationProvider.compromisedPasswordChecker = null
    AbstractUserDetailsAuthenticationProvider.hideUserNotFoundExceptions = true
    AbstractUserDetailsAuthenticationProvider.alwaysPerformAdditionalChecksOnUser = true
  eraseCredentialsAfterAuthentication = true
  parent: null
BasicAuthenticationFilter uses: org.springframework.security.authentication.ProviderManager@49dacc93
  provider: org.springframework.security.authentication.AnonymousAuthenticationProvider
  eraseCredentialsAfterAuthentication = true
  parent: org.springframework.security.authentication.ProviderManager@5e0602ff
same instance as the bean: false

package com.example.demo.lab;
 
import java.nio.charset.StandardCharsets;
 
import org.springframework.boot.CommandLineRunner;
import org.springframework.context.annotation.Profile;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder.BCryptVersion;
import org.springframework.security.crypto.factory.PasswordEncoderFactories;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Component;
 
@Component
@Profile("bcrypt")
class BcryptTour implements CommandLineRunner {
 
    @Override
    public void run(String... args) {
        BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
        String password = "Wonderland-2026";
 
        System.out.println("-- two hashes of the same password");
        String first = encoder.encode(password);
        String second = encoder.encode(password);
        System.out.println(first + "  length=" + first.length());
        System.out.println(second + "  length=" + second.length());
        System.out.println("equal=" + first.equals(second));
        System.out.println("matches(first)=" + encoder.matches(password, first)
                + " matches(second)=" + encoder.matches(password, second)
                + " matches(wrong, first)=" + encoder.matches("wonderland-2026", first));
        String[] parts = first.split("\\$");
        System.out.println("parts: version=" + parts[1] + " cost=" + parts[2]
                + " salt=" + parts[3].substring(0, 22) + " (" + parts[3].substring(0, 22).length() + ")"
                + " hash=" + parts[3].substring(22) + " (" + parts[3].substring(22).length() + ")");
 
        System.out.println("-- $2b$");
        BCryptPasswordEncoder encoder2b = new BCryptPasswordEncoder(BCryptVersion.$2B, 10);
        String hash2b = encoder2b.encode(password);
        System.out.println(hash2b + " default encoder matches=" + encoder.matches(password, hash2b));
 
        System.out.println("-- cost timings, matches(), best of 5 after one warm-up");
        for (int cost : new int[] { 10, 12, 14 }) {
            BCryptPasswordEncoder costEncoder = new BCryptPasswordEncoder(cost);
            String hash = costEncoder.encode(password);
            costEncoder.matches(password, hash);
            long best = Long.MAX_VALUE;
            for (int i = 0; i < 5; i++) {
                long start = System.nanoTime();
                costEncoder.matches(password, hash);
                best = Math.min(best, System.nanoTime() - start);
            }
            System.out.printf("cost %d: %s  %.1f ms%n", cost, hash.substring(0, 7), best / 1_000_000.0);
        }
 
        System.out.println("-- DelegatingPasswordEncoder");
        PasswordEncoder delegating = PasswordEncoderFactories.createDelegatingPasswordEncoder();
        String prefixed = delegating.encode(password);
        System.out.println(prefixed + "  length=" + prefixed.length());
        System.out.println("matches(prefixed)=" + delegating.matches(password, prefixed));
        try {
            System.out.println("matches(no prefix)=" + delegating.matches(password, first));
        } catch (RuntimeException e) {
            System.out.println(e.getClass().getName() + ": " + e.getMessage());
        }
        System.out.println("upgradeEncoding(no prefix)=" + safeUpgrade(delegating, first));
 
        System.out.println("-- 72 bytes");
        tryEncode(encoder, "72 x 'a'", "a".repeat(72));
        tryEncode(encoder, "73 x 'a'", "a".repeat(73));
        String key = "🔑";
        tryEncode(encoder, "18 x key emoji", key.repeat(18));
        tryEncode(encoder, "19 x key emoji", key.repeat(19));
        String hash72 = encoder.encode("a".repeat(72));
        try {
            System.out.println("matches(72 a + 'XYZ', hash of 72 a)=" + encoder.matches("a".repeat(72) + "XYZ", hash72));
        } catch (RuntimeException e) {
            System.out.println("matches(73+) " + e.getClass().getName() + ": " + e.getMessage());
        }
        System.out.println("matches(72 a, hash of 72 a)=" + encoder.matches("a".repeat(72), hash72));
    }
 
    private static String safeUpgrade(PasswordEncoder encoder, String hash) {
        try {
            return String.valueOf(encoder.upgradeEncoding(hash));
        } catch (RuntimeException e) {
            return e.getClass().getName() + ": " + e.getMessage();
        }
    }
 
    private static void tryEncode(PasswordEncoder encoder, String label, String raw) {
        int bytes = raw.getBytes(StandardCharsets.UTF_8).length;
        try {
            String hash = encoder.encode(raw);
            System.out.println(label + ": length()=" + raw.length() + " bytes=" + bytes + " -> " + hash);
        } catch (RuntimeException e) {
            System.out.println(label + ": length()=" + raw.length() + " bytes=" + bytes + " -> "
                    + e.getClass().getName() + ": " + e.getMessage());
        }
    }
}

java -jar build/libs/demo-0.0.1-SNAPSHOT.jar --server.port=8134 --spring.profiles.active=bcrypt

-- two hashes of the same password
$2a$10$Gk.Bb3ZvkxLiBarPBMbXwOFUm/sAwD22K4g1Wcj9Fd/dKBE9C/3Qi  length=60
$2a$10$p33Soq0G0JiR8nzodYkOHeNdIuAvwLYal4DBe7QbZM2oopSEWBxBa  length=60
equal=false
matches(first)=true matches(second)=true matches(wrong, first)=false
parts: version=2a cost=10 salt=Gk.Bb3ZvkxLiBarPBMbXwO (22) hash=FUm/sAwD22K4g1Wcj9Fd/dKBE9C/3Qi (31)
-- $2b$
$2b$10$AETHl.GhH2mcfFGy0CNrA.rBwruB2cojSnMQhSXEEUZeHSpbpcdfu default encoder matches=true

-- cost timings, matches(), best of 5 after one warm-up
cost 10: $2a$10$  55.6 ms
cost 12: $2a$12$  216.6 ms
cost 14: $2a$14$  877.3 ms

-- DelegatingPasswordEncoder
{bcrypt}$2a$10$vnYl6mrumo/KC.4MsB7fluww6/wuJAENUy3Ro8y/e.wzizFZp1dB2  length=68
matches(prefixed)=true
java.lang.IllegalArgumentException: Given that there is no default password encoder configured, each password must have a password encoding prefix. Please either prefix this password with '{noop}' or set a default password encoder in `DelegatingPasswordEncoder`.
upgradeEncoding(no prefix)=true

-- 72 bytes
72 x 'a': length()=72 bytes=72 -> $2a$10$DGKVpx9On7A.LKbDXaxv5eezqouMgRwOoF12P8OxYEHJK04sz.mae
73 x 'a': length()=73 bytes=73 -> java.lang.IllegalArgumentException: password cannot be more than 72 bytes
18 x key emoji: length()=36 bytes=72 -> $2a$10$56EwCZBrC/hOZ1FlyE1j.uy5TWcC2ccmNmXSmTLtKFa1g8mtzat6C
19 x key emoji: length()=38 bytes=76 -> java.lang.IllegalArgumentException: password cannot be more than 72 bytes
matches(72 a + 'XYZ', hash of 72 a)=true
matches(72 a, hash of 72 a)=true

package com.example.demo.user;
 
import jakarta.validation.constraints.Email;
import jakarta.validation.constraints.NotBlank;
import jakarta.validation.constraints.Pattern;
import jakarta.validation.constraints.Size;
 
public record RegisterRequest(
        @NotBlank @Size(min = 3, max = 50) @Pattern(regexp = "[a-z0-9._-]+") String username,
        @NotBlank @Email @Size(max = 254) String email,
        @NotBlank @Size(min = 8, max = 72) String password) {
}

package com.example.demo.user;
 
public record UserResponse(Long id, String username, String email, Role role) {
 
    static UserResponse from(AppUser user) {
        return new UserResponse(user.getId(), user.getUsername(), user.getEmail(), user.getRole());
    }
}

package com.example.demo.user;
 
public class UserAlreadyExistsException extends RuntimeException {
 
    public UserAlreadyExistsException(String message) {
        super(message);
    }
}

package com.example.demo.user;
 
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
 
@Service
public class UserService {
 
    private final AppUserRepository repository;
    private final PasswordEncoder passwordEncoder;
 
    public UserService(AppUserRepository repository, PasswordEncoder passwordEncoder) {
        this.repository = repository;
        this.passwordEncoder = passwordEncoder;
    }
 
    @Transactional
    public AppUser register(RegisterRequest request) {
        if (repository.existsByUsername(request.username())) {
            throw new UserAlreadyExistsException("Username " + request.username() + " is already taken");
        }
        if (repository.existsByEmail(request.email())) {
            throw new UserAlreadyExistsException("Email " + request.email() + " is already registered");
        }
        String hash = passwordEncoder.encode(request.password());
        return repository.save(new AppUser(request.username(), request.email(), hash));
    }
 
    @Transactional(readOnly = true)
    public AppUser findByUsername(String username) {
        return repository.findByUsername(username)
                .orElseThrow(() -> new UsernameNotFoundException("No user named " + username));
    }
}

package com.example.demo.user;
 
import jakarta.validation.Valid;
 
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
 
@RestController
@RequestMapping("/api/auth")
public class AuthController {
 
    private final UserService userService;
 
    public AuthController(UserService userService) {
        this.userService = userService;
    }
 
    @PostMapping("/register")
    public ResponseEntity<UserResponse> register(@Valid @RequestBody RegisterRequest request) {
        AppUser user = userService.register(request);
        return ResponseEntity.status(HttpStatus.CREATED).body(UserResponse.from(user));
    }
}

                .authorizeHttpRequests(auth -> auth
                        .requestMatchers(HttpMethod.GET, "/api/products/**").permitAll()
                        .requestMatchers(HttpMethod.POST, "/api/auth/register", "/api/auth/login").permitAll() 
                        .requestMatchers(HttpMethod.DELETE, "/api/products/**").hasRole("ADMIN")
                        .anyRequest().authenticated())

import com.example.demo.user.UserAlreadyExistsException; 
 
    @ExceptionHandler(UserAlreadyExistsException.class) 
    public ProblemDetail userExists(UserAlreadyExistsException e) { 
        return ProblemDetail.forStatusAndDetail(HttpStatus.CONFLICT, e.getMessage()); 
    } 

java -jar build/libs/demo-0.0.1-SNAPSHOT.jar --server.port=8134 --logging.level.org.hibernate.SQL=DEBUG --logging.level.org.springframework.security.authentication=DEBUG --logging.level.org.springframework.security.web.authentication.www=DEBUG '--logging.pattern.console=%logger{0}: %msg%n'

curl -i -s -H 'Content-Type: application/json' -d '{"username":"alice","email":"alice@example.com","password":"Wonderland-2026"}' http://localhost:8134/api/auth/register

HTTP/1.1 201
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Type: application/json
Transfer-Encoding: chunked
Date: Mon, 14 Sep 2026 04:42:02 GMT
 
{"id":1,"username":"alice","email":"alice@example.com","role":"USER"}

SQL: select au1_0.id from users au1_0 where au1_0.username=? fetch first ? rows only
SQL: select au1_0.id from users au1_0 where au1_0.email=? fetch first ? rows only
SQL: insert into users (email,enabled,password_hash,role,username,id) values (?,?,?,?,?,default)

docker exec sb-a34-pg psql -U demo -d demo -c 'select id, username, password_hash, length(password_hash) as len, role, enabled from users order by id'

 id | username |                        password_hash                         | len | role | enabled
----+----------+--------------------------------------------------------------+-----+------+---------
  1 | alice    | $2a$10$NKoTpp5KtZNKpR2LmYE84.dz2I/JnOOHPt0hQmnC/jqzalEjtSzpi |  60 | USER | t
  2 | carol    | $2a$10$u/wmILXQJ9Eq24Px1/eWr.m38MW57mPoG//MlgprOIEPkMN7/I.qm |  60 | USER | t
(2 rows)

curl -i -s -H 'Content-Type: application/json' -d '{"username":"Al","email":"not-an-email","password":"short"}' http://localhost:8134/api/auth/register

HTTP/1.1 422
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Type: application/problem+json
Transfer-Encoding: chunked
Date: Mon, 14 Sep 2026 04:42:02 GMT
 
{"detail":"email must be a well-formed email address, password size must be between 8 and 72, username must match \"[a-z0-9._-]+\", username size must be between 3 and 50","instance":"/api/auth/register","status":422,"title":"Unprocessable Content"}

curl -i -s -H 'Content-Type: application/json' -d '{"username":"alice","email":"alice2@example.com","password":"Another-pass-1"}' http://localhost:8134/api/auth/register

HTTP/1.1 409
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Type: application/problem+json
Transfer-Encoding: chunked
Date: Mon, 14 Sep 2026 04:42:03 GMT
 
{"detail":"Username alice is already taken","instance":"/api/auth/register","status":409,"title":"Conflict"}

{"detail":"Email alice@example.com is already registered","instance":"/api/auth/register","status":409,"title":"Conflict"}

PASSWORD=$(printf '\xF0\x9F\x94\x91%.0s' $(seq 1 19))
curl -i -s -H 'Content-Type: application/json' -d "{\"username\":\"keys\",\"email\":\"keys@example.com\",\"password\":\"$PASSWORD\"}" http://localhost:8134/api/auth/register

HTTP/1.1 302
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Set-Cookie: JSESSIONID=70FAA83D52C674B9EBA7EC8C0D75EA40; Path=/; HttpOnly
Location: http://localhost:8134/login;jsessionid=70FAA83D52C674B9EBA7EC8C0D75EA40
Content-Length: 0
Date: Mon, 14 Sep 2026 04:42:04 GMT

SQL: select au1_0.id from users au1_0 where au1_0.username=? fetch first ? rows only
SQL: select au1_0.id from users au1_0 where au1_0.email=? fetch first ? rows only
[dispatcherServlet]: Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception [Request processing failed: java.lang.IllegalArgumentException: password cannot be more than 72 bytes] with root cause
java.lang.IllegalArgumentException: password cannot be more than 72 bytes
	at org.springframework.security.crypto.bcrypt.BCrypt.hashpw(BCrypt.java:616)
	at org.springframework.security.crypto.bcrypt.BCrypt.hashpw(BCrypt.java:603)
	at org.springframework.security.crypto.bcrypt.BCrypt.hashpw(BCrypt.java:593)
	at org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder.encodeNonNullPassword(BCryptPasswordEncoder.java:109)
	at org.springframework.security.crypto.password.AbstractValidatingPasswordEncoder.encode(AbstractValidatingPasswordEncoder.java:42)
	at com.example.demo.user.UserService.register(UserService.java:27)

package com.example.demo.user;
 
import java.nio.charset.StandardCharsets; 
 
import jakarta.validation.constraints.AssertTrue; 
import jakarta.validation.constraints.Email;
import jakarta.validation.constraints.NotBlank;
import jakarta.validation.constraints.Pattern;
import jakarta.validation.constraints.Size;
 
public record RegisterRequest(
        @NotBlank @Size(min = 3, max = 50) @Pattern(regexp = "[a-z0-9._-]+") String username,
        @NotBlank @Email @Size(max = 254) String email,
        @NotBlank @Size(min = 8, max = 72) String password) {
 
    @AssertTrue(message = "must be at most 72 bytes in UTF-8") 
    public boolean isPasswordWithinBcryptLimit() { 
        return password == null || password.getBytes(StandardCharsets.UTF_8).length <= 72; 
    } 
}

HTTP/1.1 422
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Type: application/problem+json
Transfer-Encoding: chunked
Date: Mon, 14 Sep 2026 04:42:29 GMT
 
{"detail":"passwordWithinBcryptLimit must be at most 72 bytes in UTF-8","instance":"/api/auth/register","status":422,"title":"Unprocessable Content"}

package com.example.demo.user;
 
import jakarta.validation.Valid;
 
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.security.core.annotation.AuthenticationPrincipal; 
import org.springframework.security.core.userdetails.UserDetails; 
import org.springframework.web.bind.annotation.GetMapping; 
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
 
@RestController
@RequestMapping("/api/auth")
public class AuthController {
 
    private final UserService userService;
 
    public AuthController(UserService userService) {
        this.userService = userService;
    }
 
    @PostMapping("/register")
    public ResponseEntity<UserResponse> register(@Valid @RequestBody RegisterRequest request) {
        AppUser user = userService.register(request);
        return ResponseEntity.status(HttpStatus.CREATED).body(UserResponse.from(user));
    }
 
    @GetMapping("/me") 
    public UserResponse me(@AuthenticationPrincipal UserDetails principal) { 
        return UserResponse.from(userService.findByUsername(principal.getUsername())); 
    } 
}

curl -i -s -u alice:Wonderland-2026 http://localhost:8134/api/auth/me

HTTP/1.1 200
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Type: application/json
Content-Length: 69
Date: Mon, 14 Sep 2026 04:42:08 GMT
 
{"id":1,"username":"alice","email":"alice@example.com","role":"USER"}

SQL: select au1_0.id,au1_0.email,au1_0.enabled,au1_0.password_hash,au1_0.role,au1_0.username from users au1_0 where au1_0.username=?
DaoAuthenticationProvider: Authenticated user
BasicAuthenticationFilter: Set SecurityContextHolder to UsernamePasswordAuthenticationToken [Principal=org.springframework.security.core.userdetails.User [Username=alice, Password=[PROTECTED], Enabled=true, AccountNonExpired=true, CredentialsNonExpired=true, AccountNonLocked=true, Granted Authorities=[ROLE_USER]], Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=0:0:0:0:0:0:0:1, SessionId=null], Granted Authorities=[ROLE_USER, FactorGrantedAuthority [authority=FACTOR_PASSWORD, issuedAt=2026-09-14T04:42:08.004130Z]]]
SQL: select au1_0.id,au1_0.email,au1_0.enabled,au1_0.password_hash,au1_0.role,au1_0.username from users au1_0 where au1_0.username=?

AuthController: me: principal=org.springframework.security.core.userdetails.User [Username=alice, Password=[PROTECTED], Enabled=true, AccountNonExpired=true, CredentialsNonExpired=true, AccountNonLocked=true, Granted Authorities=[ROLE_USER]] | class=org.springframework.security.core.userdetails.User password=null authorities=[ROLE_USER] | authentication=org.springframework.security.authentication.UsernamePasswordAuthenticationToken credentials=null

curl -i -s -u alice:wrong-password http://localhost:8134/api/auth/me
curl -i -s -u mallory:wrong-password http://localhost:8134/api/auth/me

HTTP/1.1 401
WWW-Authenticate: Basic realm="catalogue"
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Type: application/problem+json
Content-Length: 130
Date: Mon, 14 Sep 2026 04:42:09 GMT
 
{"detail":"Valid credentials are required to access this resource.","instance":"/api/auth/me","status":401,"title":"Unauthorized"}
HTTP/1.1 401
WWW-Authenticate: Basic realm="catalogue"
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Type: application/problem+json
Content-Length: 130
Date: Mon, 14 Sep 2026 04:42:09 GMT
 
{"detail":"Valid credentials are required to access this resource.","instance":"/api/auth/me","status":401,"title":"Unauthorized"}

SQL: select au1_0.id,au1_0.email,au1_0.enabled,au1_0.password_hash,au1_0.role,au1_0.username from users au1_0 where au1_0.username=?
DaoAuthenticationProvider: Failed to authenticate since password does not match stored value
ProviderManager: Authentication failed with provider DaoAuthenticationProvider since Bad credentials
ProviderManager: Denying authentication since all attempted providers failed
BasicAuthenticationFilter: Failed to process authentication request
org.springframework.security.authentication.BadCredentialsException: Bad credentials

SQL: select au1_0.id,au1_0.email,au1_0.enabled,au1_0.password_hash,au1_0.role,au1_0.username from users au1_0 where au1_0.username=?
DaoAuthenticationProvider: Failed to find user 'mallory'
ProviderManager: Authentication failed with provider DaoAuthenticationProvider since Bad credentials
ProviderManager: Denying authentication since all attempted providers failed
BasicAuthenticationFilter: Failed to process authentication request
org.springframework.security.authentication.BadCredentialsException: Bad credentials
Caused by: org.springframework.security.core.userdetails.UsernameNotFoundException: No user named mallory

package com.example.demo.user;
 
import jakarta.validation.constraints.NotBlank;
 
public record LoginRequest(@NotBlank String username, @NotBlank String password) {
}

APPLICATION FAILED TO START
***************************
 
Description:
 
Parameter 1 of constructor in com.example.demo.user.AuthController required a bean of type 'org.springframework.security.authentication.AuthenticationManager' that could not be found.
 
 
Action:
 
Consider defining a bean of type 'org.springframework.security.authentication.AuthenticationManager' in your configuration.

import org.springframework.security.authentication.AuthenticationManager; 
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration; 
 
@Configuration
public class SecurityConfig {
 
    // apiSecurityFilterChain, webSecurityFilterChain and passwordEncoder are unchanged
 
    @Bean
    AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) { 
        return configuration.getAuthenticationManager(); 
    } 
}

package com.example.demo.user;
 
import jakarta.validation.Valid;
 
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.security.authentication.AuthenticationManager; 
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; 
import org.springframework.security.core.Authentication; 
import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
 
@RestController
@RequestMapping("/api/auth")
public class AuthController {
 
    private final UserService userService;
    private final AuthenticationManager authenticationManager; 
 
    public AuthController(UserService userService) { 
    public AuthController(UserService userService, AuthenticationManager authenticationManager) { 
        this.userService = userService;
        this.authenticationManager = authenticationManager; 
    }
 
    @PostMapping("/register")
    public ResponseEntity<UserResponse> register(@Valid @RequestBody RegisterRequest request) {
        AppUser user = userService.register(request);
        return ResponseEntity.status(HttpStatus.CREATED).body(UserResponse.from(user));
    }
 
    @PostMapping("/login") 
    public UserResponse login(@Valid @RequestBody LoginRequest request) { 
        Authentication authentication = authenticationManager.authenticate( 
                UsernamePasswordAuthenticationToken.unauthenticated(request.username(), request.password())); 
        return UserResponse.from(userService.findByUsername(authentication.getName())); 
    } 
 
    @GetMapping("/me")
    public UserResponse me(@AuthenticationPrincipal UserDetails principal) {
        return UserResponse.from(userService.findByUsername(principal.getUsername()));
    }
}

import org.springframework.http.HttpHeaders; 
import org.springframework.http.ResponseEntity; 
import org.springframework.security.authentication.BadCredentialsException; 
 
    @ExceptionHandler(BadCredentialsException.class) 
    public ResponseEntity<ProblemDetail> badCredentials(BadCredentialsException e) { 
        ProblemDetail problem = ProblemDetail.forStatusAndDetail(HttpStatus.UNAUTHORIZED, "Invalid username or password"); 
        return ResponseEntity.of(problem) 
                .header(HttpHeaders.WWW_AUTHENTICATE, "Basic realm=\"catalogue\"") 
                .build(); 
    } 

curl -i -s -H 'Content-Type: application/json' -d '{"username":"alice","password":"Wonderland-2026"}' http://localhost:8134/api/auth/login

HTTP/1.1 200
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Type: application/json
Content-Length: 69
Date: Mon, 14 Sep 2026 04:42:05 GMT
 
{"id":1,"username":"alice","email":"alice@example.com","role":"USER"}

SQL: select au1_0.id,au1_0.email,au1_0.enabled,au1_0.password_hash,au1_0.role,au1_0.username from users au1_0 where au1_0.username=?
DaoAuthenticationProvider: Authenticated user
AuthController: login result: UsernamePasswordAuthenticationToken authenticated=true principal=org.springframework.security.core.userdetails.User credentials=null
SQL: select au1_0.id,au1_0.email,au1_0.enabled,au1_0.password_hash,au1_0.role,au1_0.username from users au1_0 where au1_0.username=?

curl -i -s -H 'Content-Type: application/json' -d '{"username":"","password":""}' http://localhost:8134/api/auth/login

HTTP/1.1 422
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Type: application/problem+json
Transfer-Encoding: chunked
Date: Mon, 14 Sep 2026 04:42:07 GMT
 
{"detail":"password must not be blank, username must not be blank","instance":"/api/auth/login","status":422,"title":"Unprocessable Content"}

curl -i -s http://localhost:8134/api/auth/me

HTTP/1.1 401
WWW-Authenticate: Basic realm="catalogue"
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Type: application/problem+json
Content-Length: 130
Date: Mon, 14 Sep 2026 04:42:06 GMT
 
{"detail":"Valid credentials are required to access this resource.","instance":"/api/auth/me","status":401,"title":"Unauthorized"}

curl -i -s -H 'Content-Type: application/json' -d '{"username":"alice","password":"wrong-password"}' http://localhost:8134/api/auth/login
curl -i -s -H 'Content-Type: application/json' -d '{"username":"mallory","password":"wrong-password"}' http://localhost:8134/api/auth/login

HTTP/1.1 401
WWW-Authenticate: Basic realm="catalogue"
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Type: application/problem+json
Transfer-Encoding: chunked
Date: Mon, 14 Sep 2026 04:42:06 GMT
 
{"detail":"Invalid username or password","instance":"/api/auth/login","status":401,"title":"Unauthorized"}
HTTP/1.1 401
WWW-Authenticate: Basic realm="catalogue"
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Type: application/problem+json
Transfer-Encoding: chunked
Date: Mon, 14 Sep 2026 04:42:07 GMT
 
{"detail":"Invalid username or password","instance":"/api/auth/login","status":401,"title":"Unauthorized"}

SQL: select au1_0.id,au1_0.email,au1_0.enabled,au1_0.password_hash,au1_0.role,au1_0.username from users au1_0 where au1_0.username=?
DaoAuthenticationProvider: Failed to authenticate since password does not match stored value
ProviderManager: Authentication failed with provider DaoAuthenticationProvider since Bad credentials

SQL: select au1_0.id,au1_0.email,au1_0.enabled,au1_0.password_hash,au1_0.role,au1_0.username from users au1_0 where au1_0.username=?
DaoAuthenticationProvider: Failed to find user 'mallory'
ProviderManager: Authentication failed with provider DaoAuthenticationProvider since Bad credentials

javap -p -constants -classpath spring-security-core-7.1.1.jar:spring-security-crypto-7.1.1.jar org.springframework.security.authentication.dao.DaoAuthenticationProvider

  private static final java.lang.String USER_NOT_FOUND_PASSWORD = "userNotFoundPassword";
  private volatile java.lang.String userNotFoundEncodedPassword;
  public org.springframework.security.authentication.dao.DaoAuthenticationProvider(org.springframework.security.core.userdetails.UserDetailsService);
  protected final org.springframework.security.core.userdetails.UserDetails retrieveUser(java.lang.String, org.springframework.security.authentication.UsernamePasswordAuthenticationToken) throws org.springframework.security.core.AuthenticationException;
  private void prepareTimingAttackProtection();
  private void mitigateAgainstTimingAttack(org.springframework.security.authentication.UsernamePasswordAuthenticationToken);

docker exec sb-a34-pg psql -U demo -d demo -c "update users set enabled = false where username = 'carol'"

UPDATE 1

curl -i -s -u carol:Hatter-Tea-2026 http://localhost:8134/api/auth/me
curl -i -s -u carol:wrong-password http://localhost:8134/api/auth/me

HTTP/1.1 401
WWW-Authenticate: Basic realm="catalogue"
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Type: application/problem+json
Content-Length: 130
Date: Mon, 14 Sep 2026 04:42:23 GMT
 
{"detail":"Valid credentials are required to access this resource.","instance":"/api/auth/me","status":401,"title":"Unauthorized"}

SQL: select au1_0.id,au1_0.email,au1_0.enabled,au1_0.password_hash,au1_0.role,au1_0.username from users au1_0 where au1_0.username=?
DaoAuthenticationProvider: Failed to authenticate since user account is disabled
DaoAuthenticationProvider: Failed to authenticate since password does not match stored value
ProviderManager: Authentication failed for user 'carol' since their account status is User is disabled
org.springframework.security.authentication.DisabledException: User is disabled
ProviderManager: Denying authentication since all attempted providers failed
BasicAuthenticationFilter: Failed to process authentication request
org.springframework.security.authentication.DisabledException: User is disabled

curl -i -s -H 'Content-Type: application/json' -d '{"username":"carol","password":"Hatter-Tea-2026"}' http://localhost:8134/api/auth/login
curl -i -s -H 'Content-Type: application/json' -d '{"username":"carol","password":"wrong-password"}' http://localhost:8134/api/auth/login

HTTP/1.1 401
WWW-Authenticate: Basic realm="catalogue"
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Type: application/problem+json
Content-Length: 133
Date: Mon, 14 Sep 2026 04:42:24 GMT
 
{"detail":"Valid credentials are required to access this resource.","instance":"/api/auth/login","status":401,"title":"Unauthorized"}

import org.springframework.security.authentication.AccountStatusException; 
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.core.AuthenticationException; 
 
    @ExceptionHandler(BadCredentialsException.class) 
    public ResponseEntity<ProblemDetail> badCredentials(BadCredentialsException e) { 
    @ExceptionHandler({ BadCredentialsException.class, AccountStatusException.class }) 
    public ResponseEntity<ProblemDetail> authenticationFailed(AuthenticationException e) { 
        ProblemDetail problem = ProblemDetail.forStatusAndDetail(HttpStatus.UNAUTHORIZED, "Invalid username or password");
        return ResponseEntity.of(problem)
                .header(HttpHeaders.WWW_AUTHENTICATE, "Basic realm=\"catalogue\"")
                .build();
    }

HTTP/1.1 401
WWW-Authenticate: Basic realm="catalogue"
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Type: application/problem+json
Transfer-Encoding: chunked
Date: Mon, 14 Sep 2026 04:42:30 GMT
 
{"detail":"Invalid username or password","instance":"/api/auth/login","status":401,"title":"Unauthorized"}

> GET /api/auth/me HTTP/1.1
> Host: localhost:8134
> Authorization: Basic YWxpY2U6V29uZGVybGFuZC0yMDI2
> User-Agent: curl/8.7.1
> Accept: */*

echo YWxpY2U6V29uZGVybGFuZC0yMDI2 | base64 -d

alice:Wonderland-2026

    @Bean
    PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(); 
        return new BCryptPasswordEncoder(12); 
    }

docker exec sb-a34-pg psql -U demo -d demo -c "select username, password_hash from users order by id"

 username |                        password_hash
----------+--------------------------------------------------------------
 alice    | $2a$10$NKoTpp5KtZNKpR2LmYE84.dz2I/JnOOHPt0hQmnC/jqzalEjtSzpi
 carol    | $2a$10$u/wmILXQJ9Eq24Px1/eWr.m38MW57mPoG//MlgprOIEPkMN7/I.qm
(2 rows)

SQL: select au1_0.id,au1_0.email,au1_0.enabled,au1_0.password_hash,au1_0.role,au1_0.username from users au1_0 where au1_0.username=?
SQL: select au1_0.id,au1_0.email,au1_0.enabled,au1_0.password_hash,au1_0.role,au1_0.username from users au1_0 where au1_0.username=?
SQL: update users set email=?,enabled=?,password_hash=?,role=?,username=? where id=?
DaoAuthenticationProvider: Authenticated user
AuthController: login result: UsernamePasswordAuthenticationToken authenticated=true principal=org.springframework.security.core.userdetails.User credentials=null
SQL: select au1_0.id,au1_0.email,au1_0.enabled,au1_0.password_hash,au1_0.role,au1_0.username from users au1_0 where au1_0.username=?

 username |                        password_hash
----------+--------------------------------------------------------------
 alice    | $2a$12$hzD5SxwZqzX9LUybKoUEU.cHTCKXGP0fexFM5F3kHqiM.vlYR3qxG
 carol    | $2a$10$u/wmILXQJ9Eq24Px1/eWr.m38MW57mPoG//MlgprOIEPkMN7/I.qm
(2 rows)

SQL: select au1_0.id,au1_0.email,au1_0.enabled,au1_0.password_hash,au1_0.role,au1_0.username from users au1_0 where au1_0.username=?
DaoAuthenticationProvider: Authenticated user
AuthController: login result: UsernamePasswordAuthenticationToken authenticated=true principal=org.springframework.security.core.userdetails.User credentials=null
SQL: select au1_0.id,au1_0.email,au1_0.enabled,au1_0.password_hash,au1_0.role,au1_0.username from users au1_0 where au1_0.username=?