Wsrtjtyk

According to this answer, I should save my String BCrypt hashed password, passHash, as a BINARY or BINARY(60) (I chose BINARY(60)) when storing it in my MySQL table (I stored it in a column named passHash).

Now when I select and retrieve that passHash column value from my table into Java, it is now a byte data type.

How do I then convert it back to its String form so that I can validate it using my validateLogin() method below:

//Validate username and password login

    public boolean validateLogin(String username, String userpass) 

    {

        boolean status = false;  

        PreparedStatement pst = null; 

        ResultSet rs = null;  



        User user = new User(); //This is my Java bean class



        try(Connection connect= DBConnection.getConnection())

        {

            //Here, passHash is stored as VARBINARY(60) 

            pst = connect.prepareStatement("SELECT * FROM user WHERE username=? and passHash=?;"); 



            pst.setString(1, username);  

            pst.setString(2, userpass);  

            //Here's where I'm having difficulty because `passHash` column in my user table is VARBINARY(60) while `userpass` is a String



            rs = pst.executeQuery(); 

            status = rs.next();  

        } 



        catch (SQLException e) 

        {

            e.printStackTrace();

        }

            return status;  //status will return `true` if `username` and `userpass` matches what's in the columns

    }

The parameters username and userpass are being used to get the user's input in my Login.jsp form:

String username = request.getParameter("username");

String userpass = request.getParameter("userpass");

EDIT: My BCrypt code is as follows:

//returns a hashed String value

public static String bCrypt (String passPlain) {

        return BCrypt.hashpw(passPlain, BCrypt.gensalt(10));

    }



//Returns a true if plain password is a match with hashed password

public static Boolean isMatch(String passPlain, String passHash){

        return (BCrypt.checkpw(passPlain, passHash));

    }

When you create your user accounts, you must be hashing the passwords in some way to generate a byte in Java, which you then insert into your user table.

public static byte bCrypt (String passPlain) {

    return BCrypt.hashpw(passPlain, BCrypt.gensalt(10)).getBytes();

}



// here is how you generate the hash

byte hashed = bCrypt(userpass).toBytes();



// here is how you authenticate a login

String password; // from the UI

String sql = "SELECT passHash FROM user WHERE username = ?";

pst = connect.prepareStatement(sql);

pst.setString(1, username);

rs = pst.executeQuery();



if (rs.next()) {

    byte hash = rs.getBytes(1);

    if (isMatch(password, new String(hash))) {

        // authenticate

    }

}

The pattern for checking an existing password is to pass in the plain text password and the hash.