Spring Bootでパスワードをハッシュ化する方法｜新人エンジニア向けに解説

ユーザー登録画面
        ↓
name、email、passwordをPOST送信
        ↓
Controllerが@RequestParamで受け取る
        ↓
Serviceがpasswordをハッシュ化する
        ↓
DAOがDBに保存する

ログイン時は次の流れです。

ログイン画面
        ↓
email、passwordをPOST送信
        ↓
Controllerが@RequestParamで受け取る
        ↓
DAOがemailでユーザーを検索する
        ↓
PasswordEncoder.matchesで照合する
        ↓
一致すればログイン成功

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-crypto</artifactId>
</dependency>

package com.example.demo.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.crypto.factory.PasswordEncoderFactories;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
public class PasswordConfig {

    @Bean
    public PasswordEncoder passwordEncoder() {
        return PasswordEncoderFactories.createDelegatingPasswordEncoder();
    }
}

CREATE TABLE users (
    user_id BIGINT PRIMARY KEY AUTO_INCREMENT,
    name VARCHAR(100) NOT NULL,
    email VARCHAR(255) NOT NULL UNIQUE,
    password_hash VARCHAR(255) NOT NULL,
    created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
);

package com.example.demo.model.dto;

public class UserDto {

    private long userId;
    private String name;
    private String email;
    private String passwordHash;

    public long getUserId() {
        return userId;
    }

    public void setUserId(long userId) {
        this.userId = userId;
    }

    public String getName() {
        return name;
    }

    public void setName(String name) {
        this.name = name;
    }

    public String getEmail() {
        return email;
    }

    public void setEmail(String email) {
        this.email = email;
    }

    public String getPasswordHash() {
        return passwordHash;
    }

    public void setPasswordHash(String passwordHash) {
        this.passwordHash = passwordHash;
    }
}

package com.example.demo.dao;

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.SQLException;

/**
 * SuperDao - データベース接続の取得を担当する基底クラス
 */
public class SuperDao {

    // 接続情報は本来外部ファイル化すべきですが、教育上の簡略化のため直接記述します
    private static final String DB_URI =
    		"jdbc:mysql://localhost:3306/sip_a?characterEncoding=utf8&"
            + "useSSL=false&serverTimezone=GMT%2B9&"
            + "rewriteBatchedStatements=true";
    private static final String DB_USER = "newuser";
    private static final String DB_PASS = "0";

    /**
     * データベース接続を取得する
     * 呼び出し元で try-with-resources を使用して確実に close することを想定
     * @return データベース接続オブジェクト
     * @throws SQLException 接続失敗時にスロー
     */
    protected Connection getConnection() throws SQLException {
        return DriverManager.getConnection(DB_URI, DB_USER, DB_PASS);
    }
}

package com.example.demo.model.dao;

import com.example.demo.model.dto.UserDto;
import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import org.springframework.stereotype.Repository;

@Repository
public class UserDao extends SuperDao {

    public void insertUser(String name, String email, String passwordHash) {

        String sql =
                "INSERT INTO users (name, email, password_hash) "
              + "VALUES (?, ?, ?)";

        try (Connection con = getConnection();
             PreparedStatement ps = con.prepareStatement(sql)) {

            ps.setString(1, name);
            ps.setString(2, email);
            ps.setString(3, passwordHash);

            ps.executeUpdate();

        } catch (SQLException e) {
            throw new RuntimeException("ユーザー登録に失敗しました。", e);
        }
    }

    public UserDto findByEmail(String email) {

        String sql =
                "SELECT user_id, name, email, password_hash "
              + "FROM users "
              + "WHERE email = ?";

        try (Connection con = getConnection();
             PreparedStatement ps = con.prepareStatement(sql)) {

            ps.setString(1, email);

            try (ResultSet rs = ps.executeQuery()) {

                if (rs.next()) {
                    UserDto user = new UserDto();
                    user.setUserId(rs.getLong("user_id"));
                    user.setName(rs.getString("name"));
                    user.setEmail(rs.getString("email"));
                    user.setPasswordHash(rs.getString("password_hash"));
                    return user;
                }

                return null;
            }

        } catch (SQLException e) {
            throw new RuntimeException("ユーザー検索に失敗しました。", e);
        }
    }
}

package com.example.demo.service;

import com.example.demo.model.dao.UserDao;
import com.example.demo.model.dto.UserDto;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;

@Service
public class UserService {

    private final UserDao userDao;
    private final PasswordEncoder passwordEncoder;

    public UserService(UserDao userDao, PasswordEncoder passwordEncoder) {
        this.userDao = userDao;
        this.passwordEncoder = passwordEncoder;
    }

    public void register(String name, String email, String rawPassword) {

        String passwordHash = passwordEncoder.encode(rawPassword);

        userDao.insertUser(name, email, passwordHash);
    }

    public UserDto login(String email, String rawPassword) {

        UserDto user = userDao.findByEmail(email);

        if (user == null) {
            return null;
        }

        boolean matched =
                passwordEncoder.matches(rawPassword, user.getPasswordHash());

        if (!matched) {
            return null;
        }

        return user;
    }
}

String inputHash = passwordEncoder.encode(rawPassword);

if (inputHash.equals(user.getPasswordHash())) {
    // ログイン成功
}

boolean matched =
        passwordEncoder.matches(rawPassword, user.getPasswordHash());

package com.example.demo.controller;

import com.example.demo.model.dto.UserDto;
import com.example.demo.service.UserService;
import jakarta.servlet.http.HttpSession;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;

@Controller
public class UserController {

    private final UserService userService;

    public UserController(UserService userService) {
        this.userService = userService;
    }

    @GetMapping("/register")
    public String showRegisterForm() {
        return "user/register";
    }

    @PostMapping("/register")
    public String register(
            @RequestParam String name,
            @RequestParam String email,
            @RequestParam String password,
            Model model) {

        if (name.isBlank() || email.isBlank() || password.isBlank()) {
            model.addAttribute("errorMessage", "すべての項目を入力してください。");
            return "user/register";
        }

        userService.register(name, email, password);

        return "redirect:/login";
    }

    @GetMapping("/login")
    public String showLoginForm() {
        return "user/login";
    }

    @PostMapping("/login")
    public String login(
            @RequestParam String email,
            @RequestParam String password,
            HttpSession session,
            Model model) {

        UserDto user = userService.login(email, password);

        if (user == null) {
            model.addAttribute("errorMessage",
                    "メールアドレスまたはパスワードが正しくありません。");
            return "user/login";
        }

        session.setAttribute("loginUser", user);

        return "redirect:/mypage";
    }

    @GetMapping("/mypage")
    public String mypage(HttpSession session, Model model) {

        UserDto loginUser =
                (UserDto) session.getAttribute("loginUser");

        if (loginUser == null) {
            return "redirect:/login";
        }

        model.addAttribute("loginUser", loginUser);

        return "user/mypage";
    }
}

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org">
<head>
    <meta charset="UTF-8">
    <title>ユーザー登録</title>
</head>
<body>

<h1>ユーザー登録</h1>

<p th:if="${errorMessage}" th:text="${errorMessage}"></p>

<form th:action="@{/register}" method="post">

    <div>
        <label for="name">名前</label>
        <input type="text" id="name" name="name">
    </div>

    <div>
        <label for="email">メールアドレス</label>
        <input type="email" id="email" name="email">
    </div>

    <div>
        <label for="password">パスワード</label>
        <input type="password" id="password" name="password">
    </div>

    <button type="submit">登録</button>

</form>

</body>
</html>

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org">
<head>
    <meta charset="UTF-8">
    <title>ログイン</title>
</head>
<body>

<h1>ログイン</h1>

<p th:if="${errorMessage}" th:text="${errorMessage}"></p>

<form th:action="@{/login}" method="post">

    <div>
        <label for="email">メールアドレス</label>
        <input type="email" id="email" name="email">
    </div>

    <div>
        <label for="password">パスワード</label>
        <input type="password" id="password" name="password">
    </div>

    <button type="submit">ログイン</button>

</form>

</body>
</html>

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org">
<head>
    <meta charset="UTF-8">
    <title>マイページ</title>
</head>
<body>

<h1>マイページ</h1>

<p>ログインに成功しました。</p>

<p>
    名前：
    <span th:text="${loginUser.name}"></span>
</p>

<p>
    メールアドレス：
    <span th:text="${loginUser.email}"></span>
</p>

</body>
</html>

if (password.equals(user.getPasswordHash())) {
    return user;
}

String inputHash = passwordEncoder.encode(password);

if (inputHash.equals(user.getPasswordHash())) {
    return user;
}

boolean matched =
        passwordEncoder.matches(password, user.getPasswordHash());

if (matched) {
    return user;
}

<input name="password">
        ↓
@RequestParam String password
        ↓
passwordEncoder.encode(password)
        ↓
password_hashへ保存

ログイン時は、次の流れです。

<input name="password">
        ↓
@RequestParam String password
        ↓
DBからpassword_hashを取得
        ↓
passwordEncoder.matches(password, passwordHash)
        ↓
trueならログイン成功