Form login & Basic auth — UserDetailsService, BCrypt, DaoAuthenticationProvider

@Service
@RequiredArgsConstructor
public class AppUserDetailsService implements UserDetailsService {

  private final UserRepository userRepo;

  @Override
  @Transactional(readOnly = true)
  public UserDetails loadUserByUsername(String email) throws UsernameNotFoundException {
      AppUser user = userRepo.findByEmail(email)
          .orElseThrow(() -> new UsernameNotFoundException("User not found: " + email));

      return User.builder()
          .username(user.getEmail())
          .password(user.getPassword())                                       // raw hash
          .authorities(user.getRoles().stream()
              .map(r -> new SimpleGrantedAuthority("ROLE_" + r.getName()))     // with prefix
              .toList())
          .disabled(!user.isActive())
          .accountLocked(user.isLocked())
          .build();
  }
}

// DelegatingPasswordEncoder support multiple
@Bean
public PasswordEncoder passwordEncoder() {
  String defaultId = "argon2";
  Map<String, PasswordEncoder> encoders = Map.of(
      "argon2", new Argon2PasswordEncoder(...),
      "bcrypt12", new BCryptPasswordEncoder(12),
      "bcrypt10", new BCryptPasswordEncoder(10)             // legacy
  );
  return new DelegatingPasswordEncoder(defaultId, encoders);
}

// Existing user with {bcrypt10}$2a$10$... → upgrade to argon2 on next login

@Entity
public class AppUser {
  @Column(nullable = false)
  private boolean active = true;

  @Column(nullable = false)
  private boolean locked = false;

  @Column
  private Instant expiresAt;       // null = never expire

  @Column
  private Instant passwordChangedAt;
}

public UserDetails loadUserByUsername(String email) {
  AppUser user = userRepo.findByEmail(email).orElseThrow(...);

  Instant now = Instant.now();
  Duration passwordMaxAge = Duration.ofDays(90);

  return User.builder()
      .username(user.getEmail())
      .password(user.getPassword())
      .authorities(toAuthorities(user.getRoles()))
      .disabled(!user.isActive())
      .accountLocked(user.isLocked())
      .accountExpired(user.getExpiresAt() != null && user.getExpiresAt().isBefore(now))
      .credentialsExpired(user.getPasswordChangedAt() != null
          && user.getPasswordChangedAt().isBefore(now.minus(passwordMaxAge)))
      .build();
}

@Bean
public AuthenticationEntryPoint authEntryPoint() {
  return (req, res, ex) -> {
      String detail = switch (ex.getClass().getSimpleName()) {
          case "DisabledException" -> "Account disabled. Contact admin.";
          case "LockedException" -> "Account locked due to too many failed attempts. Try again in 30 minutes.";
          case "AccountExpiredException" -> "Account expired. Contact admin to renew.";
          case "CredentialsExpiredException" -> "Password expired. Please reset password.";
          default -> "Authentication failed.";
      };
      // ... return Problem Details with detail
  };
}

Building public REST API consumed by SPA / mobile?
→ JWT (industry standard 2026)

Server-side rendered web app (Thymeleaf, JSP)?
→ Form Login + HTTP session

Internal admin tool / monitoring dashboard?
→ HTTP Basic (simple, no UI for login)

Server-to-server API (microservice internal)?
→ JWT or mTLS (depending on security requirements)

Legacy enterprise app migrating?
→ Keep current, plan migration to JWT

@Configuration
public class SecurityConfig {

  @Bean
  @Order(1)
  public SecurityFilterChain adminChain(HttpSecurity http) throws Exception {
      http
          .securityMatcher("/admin/**")
          .httpBasic(Customizer.withDefaults())     // simple Basic for admin
          .authorizeHttpRequests(auth -> auth.anyRequest().hasRole("ADMIN"));
      return http.build();
  }

  @Bean
  @Order(2)
  public SecurityFilterChain apiChain(HttpSecurity http) throws Exception {
      http
          .securityMatcher("/api/**")
          .oauth2ResourceServer(oauth2 -> oauth2.jwt(...))     // JWT for API
          .authorizeHttpRequests(auth -> auth.anyRequest().authenticated());
      return http.build();
  }
}

@Bean
public PasswordEncoder passwordEncoder() {
  String defaultId = "argon2";   // new password use Argon2

  Map<String, PasswordEncoder> encoders = Map.of(
      "argon2", new Argon2PasswordEncoder(16, 32, 1, 4096, 3),
      "bcrypt", new BCryptPasswordEncoder(12),
      "bcrypt-old", new BCryptPasswordEncoder(10),     // legacy strength
      "noop", NoOpPasswordEncoder.getInstance()         // dev only
  );

  return new DelegatingPasswordEncoder(defaultId, encoders);
}

// Existing user (legacy)
{bcrypt-old}$2a$10$EhSpMo65...

// New user (after upgrade)
{argon2}$argon2id$v=19$m=4096,t=3,p=1$...

// Match flow:
// 1. User input "raw_password"
// 2. Encoder read prefix {argon2} from stored hash
// 3. Lookup encoder map → Argon2PasswordEncoder
// 4. argon2.matches("raw_password", "$argon2id$...") → boolean

// Migration script — re-hash all user passwords
// CANNOT — we don't know plaintext
// Option: force all users reset password trên next login

UPDATE users SET force_password_reset = true;

@Component
public class PasswordUpgradeListener {

  private final PasswordEncoder encoder;
  private final UserRepository userRepo;

  @EventListener
  public void on(AuthenticationSuccessEvent event) {
      String username = event.getAuthentication().getName();
      String rawPassword = (String) event.getAuthentication().getCredentials();

      // Note: credential cleared by default — disable for upgrade
      if (rawPassword == null) return;

      AppUser user = userRepo.findByEmail(username).orElseThrow();
      String currentHash = user.getPassword();

      if (currentHash.startsWith("{bcrypt-old}") || !currentHash.startsWith("{argon2}")) {
          String newHash = encoder.encode(rawPassword);   // re-hash with default (argon2)
          user.setPassword(newHash);
          userRepo.save(user);
          log.info("Upgraded password hash for user {}", username);
      }
  }
}

@Bean
public AuthenticationManager authManager(...) {
  DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
  // ...

  ProviderManager pm = new ProviderManager(provider);
  pm.setEraseCredentialsAfterAuthentication(false);    // KEEP credential for upgrade listener
  return pm;
}

@Service
public class AppUserDetailsService implements UserDetailsService, UserDetailsPasswordService {

  public UserDetails updatePassword(UserDetails user, String newPassword) {
      AppUser appUser = userRepo.findByEmail(user.getUsername()).orElseThrow();
      appUser.setPassword(newPassword);     // already-encoded by Spring
      userRepo.save(appUser);
      return user.withPassword(newPassword);
  }
}

-- Track migration progress
SELECT
  SUBSTRING(password FROM '^\{[^}]+\}') AS hash_type,
  COUNT(*) AS count
FROM users
GROUP BY hash_type;

-- Goal: 100% {argon2} eventually

Failed login attempt → AuthenticationFailureBadCredentialsEvent
       ↓
LoginAttemptListener (event handler)
       ↓
LoginAttemptService (track count)
       ↓ (if exceed threshold)
UserService.lockAccount(username)
       ↓
Next login: UserDetails.isAccountNonLocked() = false
       ↓
LockedException → 401

@Service
@RequiredArgsConstructor
public class LoginAttemptService {

  private final RedisTemplate<String, Integer> redisTemplate;
  private final UserRepository userRepo;

  private static final int MAX_ATTEMPTS = 5;
  private static final Duration WINDOW = Duration.ofMinutes(15);
  private static final Duration LOCKOUT = Duration.ofMinutes(30);

  public void loginFailed(String username) {
      String key = "login_attempts:" + username;
      Integer current = redisTemplate.opsForValue().get(key);

      if (current == null) {
          redisTemplate.opsForValue().set(key, 1, WINDOW);
      } else {
          redisTemplate.opsForValue().set(key, current + 1, WINDOW);
      }

      if (current != null && current + 1 >= MAX_ATTEMPTS) {
          lockAccount(username);
      }
  }

  public void loginSucceeded(String username) {
      String key = "login_attempts:" + username;
      redisTemplate.delete(key);
  }

  private void lockAccount(String username) {
      userRepo.findByEmail(username).ifPresent(user -> {
          user.setLocked(true);
          user.setLockedUntil(Instant.now().plus(LOCKOUT));
          userRepo.save(user);
          log.warn("Account locked: {}", username);
      });
  }

  public boolean isLocked(String username) {
      return userRepo.findByEmail(username)
          .map(user -> user.isLocked() &&
              user.getLockedUntil() != null &&
              user.getLockedUntil().isAfter(Instant.now()))
          .orElse(false);
  }
}

@Component
@RequiredArgsConstructor
public class LoginAttemptListener {

  private final LoginAttemptService loginAttemptService;

  @EventListener
  public void onFailure(AuthenticationFailureBadCredentialsEvent event) {
      String username = event.getAuthentication().getName();
      loginAttemptService.loginFailed(username);
  }

  @EventListener
  public void onSuccess(AuthenticationSuccessEvent event) {
      String username = event.getAuthentication().getName();
      loginAttemptService.loginSucceeded(username);
  }
}

@Service
public class AppUserDetailsService implements UserDetailsService {

  public UserDetails loadUserByUsername(String email) {
      AppUser user = userRepo.findByEmail(email).orElseThrow(...);

      boolean locked = user.isLocked() &&
          user.getLockedUntil() != null &&
          user.getLockedUntil().isAfter(Instant.now());

      // Auto-unlock if lockout expired
      if (user.isLocked() && user.getLockedUntil().isBefore(Instant.now())) {
          user.setLocked(false);
          user.setLockedUntil(null);
          userRepo.save(user);
          locked = false;
      }

      return User.builder()
          .username(user.getEmail())
          .password(user.getPassword())
          .authorities(...)
          .accountLocked(locked)
          .build();
  }
}

-- V4__add_lockout.sql
ALTER TABLE users ADD COLUMN locked_until TIMESTAMPTZ;
CREATE INDEX idx_users_locked_until ON users(locked_until) WHERE locked_until IS NOT NULL;