Are hashed passwords allowed in simple auth?

[dangarciahe]

I've been trying to store hashed passwords instead of their plain-text version when using simple auth method, but have so far failed.

Spring boot documentation indicates that this should be allowed, but I found no mention on this in Shiny Proxy documentation.

What I tried was:

proxy:
  users:
    - name: jeff
      password: $2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG

but this simply makes the new password the hashed value, not the string that produced this hash.

I also tried adding {bcrypt} as a prefix: password: {bcrypt}$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG, as outlined in Boot Spring docs, but this causes Shiny Proxy to crash.

Is it possible to store hashed passwords instead of plain-text ones when using simple auth?

This was tested in Shiny Proxy 3.2.3

[billy34]

In ContainerProxy (workhorse behind shinyproxy) we can find in SimpleAuthenticationBackend.java the following line (around line 74)

userDetails
       .withUser(user.name)
       .password("{noop}" + user.password)
       .roles(user.roles);

password being read near line 87 by

String password = environment.getProperty(String.format("proxy.users[%d].password", index));

Which means that no encoding is used ({noop}). So password must be provided as unencoded plain text.

[dangarciahe]

I see. Thanks for the answer, Billy.

[LEDfan]

Hi, this is indeed currently not possible.
However, I like the suggestions, since this would improve the security, therefore, I re-opened this issue and we will consider implementing this in the next release.