Question

I want to use bcrypt hashing algorithm in my grails project instead of its defaultSHA-256 message digest algorithm. To enable bcrypt, you just use the grails install-plugin spring-security-bcrypt command.

You can customize keying rounds by adding this to BuildConfig.groovy:

grails.plugins.springsecurity.password.bcrypt.logrounds = 15

My question is, is that all I need to do to set bcrypt as my password algorithm? Does it automatically use the bcrypt algorithm when I use this method from the domain class generated by spring-security-core:

springSecurityService.encodePassword(params.password)

How do I check if bcrypt is working on my project?

Answer 1

You also need to add

grails.plugins.springsecurity.password.algorithm='bcrypt'