Class PasswordNormalizer

java.lang.Object
com.svenruppert.jsentinel.credential.input.PasswordNormalizer
public final class PasswordNormalizer extends Object
Normalises password material under the active PasswordInputPolicy so that two equivalent Unicode representations of the same characters compare equal across hash/verify (CWE-176).

JVM memory honesty

The JDK's Normalizer.normalize(CharSequence, Normalizer.Form) returns a String. String instances are immutable and may be retained by the JVM. The normalizer copies that String into a fresh SecretValue and discards the reference, but a brief window remains where the normalised material lives in a String object. This is the same caveat documented on SecretValue; see CWE-226.

Pre-hashing of overlong inputs is intentionally not performed here. The Konzept ยง11 forbids silent pre-hashing without a real pepper service (password shucking risk); the bcrypt provider rejects overlong inputs explicitly.

  • Constructor Details

    • PasswordNormalizer

      public PasswordNormalizer()

  • Method Details

    • normalize

      public SecretValue normalize(SecretValue input, PasswordInputPolicy policy)
      Returns a new SecretValue containing the normalised form. The input is left intact (callers are usually mid-pipeline and close their own secret in a try-with-resources block).