Securing Default Credentials

@RestController
@RequestMapping("/api/admin")
public class AdminController {
    
    // Default admin credentials (NEVER do this in production)
    private static final String DEFAULT_USERNAME = "admin";
    private static final String DEFAULT_PASSWORD = "admin123";

    @PostMapping("/login")
    public ResponseEntity<?> login(@RequestBody LoginRequest loginRequest) {
        String username = loginRequest.username();
        String password = loginRequest.password();

        // If default credentials are still active, an attacker can log in
        if (DEFAULT_USERNAME.equals(username) && DEFAULT_PASSWORD.equals(password)) {
            Map<String, String> response = new HashMap<>();
            response.put("message", "Login successful");
            response.put("access", "FULL_ADMIN");
            return ResponseEntity.ok(response);
        }

        return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                .body(Map.of("error", "Unauthorized"));
    }
    
    public record LoginRequest(String username, String password) {}
}

@GetMapping("/users")
public ResponseEntity<?> getUsers(@RequestHeader(value = "access", required = false) String access) {
    // If attacker logs in using default credentials, they can dump user data
    if ("FULL_ADMIN".equals(access)) {
        List<Map<String, Object>> users = Arrays.asList(
            Map.of("id", 1, "name", "Alice"),
            Map.of("id", 2, "name", "Bob")
        );
        return ResponseEntity.ok(users);
    }

    return ResponseEntity.status(HttpStatus.FORBIDDEN)
            .body(Map.of("error", "Forbidden"));
}

# Step 1: Login with default credentials
curl -X POST http://localhost:8080/api/admin/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"admin123"}'

# Response: {"message":"Login successful","access":"FULL_ADMIN"}

# Step 2: Access protected endpoint with the access header
curl -X GET http://localhost:8080/api/admin/users \
  -H "access: FULL_ADMIN"

# Response: [{"id":1,"name":"Alice"},{"id":2,"name":"Bob"}]

@Entity
@Table(name = "users")
public class User {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Integer id;

    @Column(unique = true, nullable = false)
    private String username;

    @Column(nullable = false)
    private String password;

    @Enumerated(EnumType.STRING)
    @Column(nullable = false)
    private Role role;

    // Constructors, getters, and setters
    public User() {}

    public Integer getId() {
        return id;
    }

    public void setId(Integer id) {
        this.id = id;
    }

    public String getUsername() {
        return username;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }

    public Role getRole() {
        return role;
    }

    public void setRole(Role role) {
        this.role = role;
    }
}

public enum Role {
    USER,
    ADMIN
}

@Repository
public interface UserRepository extends JpaRepository<User, Integer> {
    Optional<User> findByUsername(String username);
}

@Component
public class DataInitializer implements ApplicationRunner {
    private final UserRepository users;
    private final PasswordEncoder encoder;
    
    @Value("${app.admin.username:}")
    private String adminUsername;
    
    @Value("${app.admin.password:}")
    private String adminPassword;

    public DataInitializer(UserRepository users, PasswordEncoder encoder) {
        this.users = users;
        this.encoder = encoder;
    }

    @Override
    public void run(ApplicationArguments args) {
        try {
            if (adminUsername == null || adminUsername.isBlank() ||
                adminPassword == null || adminPassword.isBlank()) {
                throw new IllegalStateException("Missing admin credentials in configuration");
            }

            String hashedPassword = encoder.encode(adminPassword);
            
            users.findByUsername(adminUsername).orElseGet(() -> {
                User u = new User();
                u.setUsername(adminUsername);
                u.setPassword(hashedPassword);
                u.setRole(Role.ADMIN);
                return users.save(u);
            });
            
            System.out.println("Admin user created/verified successfully");
        } catch (Exception e) {
            System.err.println("Error initializing admin user: " + e.getMessage());
        }
    }
}

server:
  port: 3001

spring:
  datasource:
    url: jdbc:sqlite:database.sqlite
    driver-class-name: org.sqlite.JDBC
  jpa:
    database-platform: org.hibernate.community.dialect.SQLiteDialect
    hibernate:
      ddl-auto: update

app:
  jwt:
    secret: your-very-long-and-very-secure-jwt-secret-key
  admin:
    username: sys_admin_acme
    password: X2k9#mP$vL5@qR8n

@Configuration
public class SecurityConfiguration {
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

@Component
public class JwtUtil {
    private final Algorithm algorithm;
    private final JWTVerifier verifier;

    public JwtUtil(@Value("${app.jwt.secret}") String secret) {
        this.algorithm = Algorithm.HMAC256(secret);
        this.verifier = JWT.require(algorithm).build();
    }

    public String generateTokenWithUserId(Integer userId) {
        return JWT.create()
                .withClaim("userId", userId)
                .sign(algorithm);
    }

    // Generates a JWT token containing the user's ID and role
    // The token expires after 1 hour to limit the window of exposure if compromised
    public String generateTokenWithRole(Integer userId, String role) {
        return JWT.create()
                .withClaim("userId", userId)
                .withClaim("role", role)
                .withExpiresAt(Instant.now().plus(1, ChronoUnit.HOURS))
                .sign(algorithm);
    }

    public DecodedJWT verify(String token) {
        return verifier.verify(token);
    }
}

@RestController
@RequestMapping("/api/admin")
public class AdminController {
    
    private final UserRepository users;
    private final JwtUtil jwt;
    private final PasswordEncoder passwordEncoder;

    public AdminController(UserRepository users, JwtUtil jwt, PasswordEncoder passwordEncoder) {
        this.users = users;
        this.jwt = jwt;
        this.passwordEncoder = passwordEncoder;
    }

    private ResponseEntity<ErrorResponse> error(HttpStatus status, String detail) {
        return ResponseEntity.status(status).body(new ErrorResponse(detail));
    }

    @PostMapping("/login")
    public ResponseEntity<?> login(@RequestBody LoginRequest request) {
        Optional<User> adminUser = users.findByUsername(request.username());
        
        if (adminUser.isEmpty()) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                .body(Map.of("error", "Unauthorized"));
        }

        boolean isValidPassword = passwordEncoder.matches(
            request.password(), 
            adminUser.get().getPassword()
        );

        if (isValidPassword) {
            String token = jwt.generateTokenWithRole(
                adminUser.get().getId(),
                adminUser.get().getRole().toString()
            );
            return ResponseEntity.ok(Map.of("token", token));
        }

        return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
            .body(Map.of("error", "Unauthorized"));
    }

    public record LoginRequest(String username, String password) {}
}

public class ErrorResponse {
    private String error;

    public ErrorResponse(String error) {
        this.error = error;
    }

    public String getError() {
        return error;
    }

    public void setError(String error) {
        this.error = error;
    }
}

private AdminOutcome verifyAdminOrError(String authorizationHeader) {
    if (authorizationHeader == null || authorizationHeader.isBlank()) {
        return new AdminOutcome(null, error(HttpStatus.UNAUTHORIZED, "Missing authorization header"));
    }
    
    String token = authorizationHeader.startsWith("Bearer ") 
        ? authorizationHeader.substring(7) 
        : authorizationHeader;
    
    try {
        DecodedJWT decoded = jwt.verify(token);
        Integer userId = decoded.getClaim("userId").asInt();
        var userOpt = users.findById(userId);
        
        if (userOpt.isEmpty()) {
            return new AdminOutcome(null, error(HttpStatus.UNAUTHORIZED, "User not found"));
        }
        
        User u = userOpt.get();
        if (u.getRole() != Role.ADMIN) {
            return new AdminOutcome(null, error(HttpStatus.FORBIDDEN, "Admin access required"));
        }
        
        return new AdminOutcome(u, null);
    } catch (Exception e) {
        return new AdminOutcome(null, error(HttpStatus.FORBIDDEN, "Admin access required"));
    }
}

private record AdminOutcome(User user, ResponseEntity<ErrorResponse> error) {}

@GetMapping("/users")
public ResponseEntity<?> getUsers(
        @RequestHeader(value = "authorization", required = false) String authorization) {
    
    var outcome = verifyAdminOrError(authorization);
    if (outcome.error() != null) {
        return outcome.error();
    }

    List<Map<String, Object>> usersList = users.findAll().stream()
        .map(u -> Map.<String, Object>of(
            "id", u.getId(),
            "username", u.getUsername(),
            "role", u.getRole().toString()
        ))
        .toList();

    return ResponseEntity.ok(Map.of("users", usersList));
}

# Step 1: Login with proper credentials from configuration
curl -X POST http://localhost:3001/api/admin/login \
  -H "Content-Type: application/json" \
  -d '{"username":"sys_admin_acme","password":"X2k9#mP$vL5@qR8n"}'

# Response: {"token":"eyJ0eXAiOiJKV1QiLCJhbGc..."}

# Step 2: Access protected endpoint with the JWT token
curl -X GET http://localhost:3001/api/admin/users \
  -H "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGc..."

# Response: {"users":[{"id":1,"username":"sys_admin_acme","role":"ADMIN"}]}

# Step 3: Try accessing without a token (should fail)
curl -X GET http://localhost:3001/api/admin/users

# Response: {"error":"Missing authorization header"}