Securing Password Recovery

@RestController
@RequestMapping("/api")
public class PasswordRecoveryController {

    @Autowired
    private UserRepository userRepository;

    @Autowired
    private BCryptPasswordEncoder passwordEncoder;

    @PostMapping("/recover-password")
    public ResponseEntity<?> recoverPassword(@RequestBody RecoveryRequest request) {
        Optional<User> userOptional = userRepository.findByUsername(request.getUsername());
        
        if (userOptional.isEmpty()) {
            return ResponseEntity.status(404)
                .body(Map.of("error", "User not found"));
        }
        
        User user = userOptional.get();
        // ...rest of the code follows
    }
}

        if (request.getSecurityAnswer().equals(user.getSecurityAnswer())) {
            String tempPassword = UUID.randomUUID().toString().substring(0, 8);
            String hashedPassword = passwordEncoder.encode(tempPassword);
            user.setPassword(hashedPassword);
            userRepository.save(user);
            
            return ResponseEntity.ok(Map.of("newPassword", tempPassword));
        } else {
            return ResponseEntity.status(401)
                .body(Map.of("error", "Incorrect security answer"));
        }
    }
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.util.List;

public class RecoveryAttack {
    
    private static final List<String> COMMON_DOG_NAMES = List.of(
        "Max", "Bella", "Luna", "Charlie", "Lucy", "Cooper", "Daisy", "Milo",
        "Bailey", "Rocky", "Bear", "Shadow", "Jack", "Sadie", "Buddy"
    );
    
    private static final HttpClient httpClient = HttpClient.newHttpClient();
    
    public static void attemptRecovery(String username) {
        for (String name : COMMON_DOG_NAMES) {
            try {
                String jsonBody = String.format(
                    "{\"username\":\"%s\",\"securityAnswer\":\"%s\"}", 
                    username, name
                );
                
                HttpRequest request = HttpRequest.newBuilder()
                    .uri(URI.create("http://localhost:8080/api/recover-password"))
                    .header("Content-Type", "application/json")
                    .POST(HttpRequest.BodyPublishers.ofString(jsonBody))
                    .build();
                
                HttpResponse<String> response = httpClient.send(request, 
                    HttpResponse.BodyHandlers.ofString());
                
                System.out.println("Response status: " + response.statusCode() + 
                    ", Body: " + response.body());
                
                if (response.statusCode() == 200 && response.body().contains("newPassword")) {
                    System.out.println("Success! Answer found: " + name + 
                        ", Response: " + response.body());
                    return;
                }
            } catch (Exception e) {
                System.err.println("Error making request: " + e.getMessage());
            }
        }
        
        System.out.println("Recovery attempt completed. No successful matches found.");
    }
    
    public static void main(String[] args) {
        attemptRecovery("targetUser");
    }
}

@RestController
@RequestMapping("/api")
public class RecoverPasswordController {

    private final UserRepository users;
    private final EmailUtil emailUtil;
    private final CryptoUtil cryptoUtil;
    private final PasswordEncoder passwordEncoder;

    public RecoverPasswordController(UserRepository users, EmailUtil emailUtil, 
                                     CryptoUtil cryptoUtil, PasswordEncoder passwordEncoder) {
        this.users = users;
        this.emailUtil = emailUtil;
        this.cryptoUtil = cryptoUtil;
        this.passwordEncoder = passwordEncoder;
    }

    @PostMapping("/recover-password")
    public ResponseEntity<?> recoverPassword(@RequestBody RecoverPasswordRequest request) {
        try {
            String username = request.username();

            // If username is null or empty, still return the standard message
            if (username == null || username.isBlank()) {
                return ResponseEntity.ok(Map.of("message", 
                    "If an account exists, a reset link will be sent"));
            }

            User user = users.findByUsername(username).orElse(null);
            if (user == null) {
                return ResponseEntity.ok(Map.of("message", 
                    "If an account exists, a reset link will be sent"));
            }

            CryptoUtil.TokenPair tokenPair = cryptoUtil.generateResetToken();
            
            user.setResetToken(tokenPair.tokenHash()); // Store the hashed version
            user.setResetTokenExpires(new Date(System.currentTimeMillis() + 3600000)); // 1 hour
            users.save(user);

            emailUtil.sendPasswordResetEmail(user.getEmail(), tokenPair.token());
            
            return ResponseEntity.ok(Map.of("message", 
                "Check your email for further instructions."));
        } catch (Exception e) {
            System.err.println("Password recovery error: " + e.getMessage());
            // Always return 200 status code with the generic message
            return ResponseEntity.ok(Map.of("message", 
                "If an account exists, a reset link will be sent"));
        }
    }
    
    public record RecoverPasswordRequest(String username) {}
}

            CryptoUtil.TokenPair tokenPair = cryptoUtil.generateResetToken();
            
            user.setResetToken(tokenPair.tokenHash()); // Store the hashed version
            user.setResetTokenExpires(new Date(System.currentTimeMillis() + 3600000)); // 1 hour
            users.save(user);

            emailUtil.sendPasswordResetEmail(user.getEmail(), tokenPair.token());
            
            return ResponseEntity.ok(Map.of("message", 
                "Check your email for further instructions."));

    @PostMapping("/reset-password")
    public ResponseEntity<?> resetPassword(@RequestBody ResetPasswordRequest request) {
        try {
            String token = request.token();
            String newPassword = request.newPassword();
            
            // Hash the provided token to compare with stored hash
            String tokenHash = cryptoUtil.hashToken(token);
            
            User user = users.findByResetTokenAndResetTokenExpiresAfter(tokenHash, new Date())
                .orElse(null);

            // Make sure the token hasn't expired
            if (user == null) {
                return ResponseEntity.status(HttpStatus.BAD_REQUEST)
                    .body(new ErrorResponse("Invalid or expired reset token"));
            }

            String hashedPassword = passwordEncoder.encode(newPassword);
            user.setPassword(hashedPassword);
            user.setResetToken(null);
            user.setResetTokenExpires(null);
            users.save(user);

            return ResponseEntity.ok(Map.of("message", "Password successfully reset"));
        } catch (Exception e) {
            System.err.println("Password reset error: " + e.getMessage());
            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
                .body(new ErrorResponse("Internal server error"));
        }
    }
    
    public record ResetPasswordRequest(String token, String newPassword) {}
}

import java.security.MessageDigest;
import java.security.SecureRandom;
import org.springframework.stereotype.Component;

@Component
public class CryptoUtil {
    
    private final SecureRandom secureRandom = new SecureRandom();
    
    public TokenPair generateResetToken() throws Exception {
        byte[] buffer = new byte[32];
        secureRandom.nextBytes(buffer);
        
        String token = bytesToHex(buffer);
        String tokenHash = hashToken(token);
        
        return new TokenPair(token, tokenHash);
    }
    
    public String hashToken(String token) {
        try {
            MessageDigest digest = MessageDigest.getInstance("SHA-256");
            byte[] hashBytes = digest.digest(token.getBytes());
            return bytesToHex(hashBytes);
        } catch (Exception e) {
            throw new RuntimeException("Failed to hash token", e);
        }
    }
    
    private String bytesToHex(byte[] bytes) {
        StringBuilder result = new StringBuilder();
        for (byte b : bytes) {
            result.append(String.format("%02x", b));
        }
        return result.toString();
    }
    
    public record TokenPair(String token, String tokenHash) {}
}