Replace Spring Security Base64 with java.util equivalent by gdgenchev · Pull Request #3857 · cloudfoundry/uaa

gdgenchev · 2026-04-22T08:55:05Z

org.springframework.security.crypto.codec.Base64 was deprecated in Spring Security 6 and later removed in Spring Security 7. Replaced with java.util.Base64.

Spring Security 7 removed the Base64 class from the spring-security-crypto.codec package. Replaced with java.util.Base64 in all files that used org.springframework.security.crypto.codec.Base64. Related to Spring Boot 4 migration.

Copilot

Pull request overview

Replaces deprecated Spring Security org.springframework.security.crypto.codec.Base64 usage with java.util.Base64 to maintain compatibility with Spring Security 6+ and prepare for Spring Security 7.

Changes:

Swapped Spring Security Base64 imports for java.util.Base64 across several unit/integration tests.
Updated Basic Auth header construction to use Base64.getEncoder().encode(...).
Updated UserNotFoundEvent to use java.util.Base64 for hashing/encoding the username in audit events.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/token/TokenMvcMockZonePathTests.java	Replace Spring Base64 with JDK Base64 in multiple Basic Auth header constructions.
uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/token/TokenMvcMockTests.java	Same Base64 replacement for token endpoint tests.
uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/limited/LimitedModeTokenMockMvcTests.java	Same Base64 replacement in limited-mode check_token test.
uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginInfoEndpointDocs.java	Same Base64 replacement in REST docs test for autologin.
uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/ScimGroupEndpointsIntegrationTests.java	Same Base64 replacement in client-credentials token helper.
uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/NativeApplicationIntegrationTests.java	Same Base64 replacement in Basic auth header for negative test.
uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/CheckTokenEndpointIntegrationTests.java	Same Base64 replacement in forbidden check_token test.
server/src/test/java/org/cloudfoundry/identity/uaa/test/UaaTestAccounts.java	Same Base64 replacement for shared test helper building Basic auth headers.
server/src/main/java/org/cloudfoundry/identity/uaa/authentication/event/UserNotFoundEvent.java	Replace Spring Base64 with JDK Base64 in audit-event name hashing/encoding.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-22T09:11:07Z

        ScimUser developer = setUpUser(jdbcScimUserProvisioning, jdbcScimGroupMembershipManager, jdbcScimGroupProvisioning, userId, userScopes, OriginKeys.LOGIN_SERVER, IdentityZoneHolder.get().getId());
        String loginToken = testClient.getClientCredentialsOAuthAccessToken("login", "loginsecret", "");
-        String basicAuthForLoginClient = new String(Base64.encode("%s:%s".formatted("login", "loginsecret").getBytes()));
+        String basicAuthForLoginClient = new String(Base64.getEncoder().encode("%s:%s".formatted("login", "loginsecret").getBytes()));


new String(Base64.getEncoder().encode(...)) relies on the platform default charset when converting the encoded bytes to a String. Use Base64.getEncoder().encodeToString(...) instead (and prefer getBytes(StandardCharsets.UTF_8) for the credential bytes) to make the Authorization header deterministic across platforms. This pattern appears multiple times in this file.

Suggested change

String basicAuthForLoginClient = new String(Base64.getEncoder().encode("%s:%s".formatted("login", "loginsecret").getBytes()));

String basicAuthForLoginClient = Base64.getEncoder().encodeToString("%s:%s".formatted("login", "loginsecret").getBytes(StandardCharsets.UTF_8));

Copilot · 2026-04-22T09:11:08Z

                                .header(AUTHORIZATION,
-                                        "Basic " + new String(Base64.encode((client.getClientId() + ":" + SECRET).getBytes())))
+                                        "Basic " + new String(Base64.getEncoder().encode((client.getClientId() + ":" + SECRET).getBytes())))


For Basic auth, avoid new String(Base64.getEncoder().encode(...)) because it depends on the default charset for the byte[]->String conversion. Prefer Base64.getEncoder().encodeToString((clientId + ":" + secret).getBytes(StandardCharsets.UTF_8)) (or US_ASCII for the encoded output) so the Authorization header is stable across environments.

Copilot · 2026-04-22T09:11:08Z

        String body = mockMvc.perform(
                post("/autologin")
-                        .header("Authorization", "Basic " + new String(Base64.encode("admin:adminsecret".getBytes())))
+                        .header("Authorization", "Basic " + new String(Base64.getEncoder().encode("admin:adminsecret".getBytes())))


"Basic " + new String(Base64.getEncoder().encode(...)) is charset-dependent due to new String(byte[]). Prefer Base64.getEncoder().encodeToString("admin:adminsecret".getBytes(StandardCharsets.UTF_8)) (or specify US_ASCII for the encoded output) to avoid platform-specific behavior.

Copilot · 2026-04-22T09:11:08Z

        headers.set("Authorization",
-                "Basic " + new String(Base64.encode("%s:%s".formatted(clientId, clientSecret).getBytes())));
+                "Basic " + new String(Base64.getEncoder().encode("%s:%s".formatted(clientId, clientSecret).getBytes())));


Building the Basic auth header via new String(Base64.getEncoder().encode(...)) makes the result depend on the platform default charset. Use Base64.getEncoder().encodeToString(... ) and pass an explicit charset to getBytes(...) (e.g., StandardCharsets.UTF_8) so the header is deterministic.

Copilot · 2026-04-22T09:11:09Z

        formData.add("scope", "cloud_controller.read");
        HttpHeaders headers = new HttpHeaders();
-        headers.set("Authorization", "Basic " + new String(Base64.encode("no-such-client:".getBytes(StandardCharsets.UTF_8))));
+        headers.set("Authorization", "Basic " + new String(Base64.getEncoder().encode("no-such-client:".getBytes(StandardCharsets.UTF_8))));


Even though the input uses StandardCharsets.UTF_8, wrapping Base64.getEncoder().encode(...) in new String(...) still uses the platform default charset for decoding the Base64 bytes. Prefer Base64.getEncoder().encodeToString(...) to avoid charset-dependent behavior.

Suggested change

headers.set("Authorization", "Basic " + new String(Base64.getEncoder().encode("no-such-client:".getBytes(StandardCharsets.UTF_8))));

headers.set("Authorization", "Basic " + Base64.getEncoder().encodeToString("no-such-client:".getBytes(StandardCharsets.UTF_8)));

Copilot · 2026-04-22T09:11:09Z

        formData.add("token", "FOO");
        HttpHeaders headers = new HttpHeaders();
-        headers.set("Authorization", "Basic " + new String(Base64.encode("cf:".getBytes(UTF_8))));
+        headers.set("Authorization", "Basic " + new String(Base64.getEncoder().encode("cf:".getBytes(UTF_8))));


new String(Base64.getEncoder().encode(...)) uses the platform default charset to decode the encoded bytes, which is not guaranteed to be ASCII-compatible on all JVMs. Prefer Base64.getEncoder().encodeToString("cf:".getBytes(UTF_8)) (or specify US_ASCII for the output) for a deterministic Basic auth header.

Suggested change

headers.set("Authorization", "Basic " + new String(Base64.getEncoder().encode("cf:".getBytes(UTF_8))));

headers.set("Authorization", "Basic " + Base64.getEncoder().encodeToString("cf:".getBytes(UTF_8)));

Copilot · 2026-04-22T09:11:09Z

        String credentials =
                "%s:%s".formatted(URLEncoder.encode(username, StandardCharsets.UTF_8), URLEncoder.encode(password, StandardCharsets.UTF_8));
-        return "Basic %s".formatted(new String(Base64.encode(credentials.getBytes())));
+        return "Basic %s".formatted(new String(Base64.getEncoder().encode(credentials.getBytes())));


new String(Base64.getEncoder().encode(credentials.getBytes())) is charset-dependent twice: getBytes() uses the platform default charset, and new String(...) decodes Base64 bytes using the platform default charset. Prefer Base64.getEncoder().encodeToString(credentials.getBytes(StandardCharsets.UTF_8)) to make the Basic auth header deterministic across platforms.

Suggested change

return "Basic %s".formatted(new String(Base64.getEncoder().encode(credentials.getBytes())));

return "Basic %s".formatted(Base64.getEncoder().encodeToString(credentials.getBytes(StandardCharsets.UTF_8)));

Copilot · 2026-04-22T09:11:10Z

            // Store hash of name, to conceal accidental entry of sensitive info
            // (e.g. password)
-            name = Utf8.decode(Base64.encode(MessageDigest.getInstance("SHA-1").digest(Utf8.encode(name))));
+            name = Utf8.decode(Base64.getEncoder().encode(MessageDigest.getInstance("SHA-1").digest(Utf8.encode(name))));


Since this change already moves off Spring Security's Base64, consider also removing the remaining org.springframework.security.crypto.codec.Utf8 usage here: Base64.getEncoder().encodeToString(MessageDigest...digest(name.getBytes(StandardCharsets.UTF_8))) produces the same value and avoids depending on Spring's deprecated codec utilities (which may also be removed in Spring Security 7).

Copilot · 2026-04-22T09:11:10Z

        ScimUser developer = setUpUser(jdbcScimUserProvisioning, jdbcScimGroupMembershipManager, jdbcScimGroupProvisioning, userId, userScopes, OriginKeys.LOGIN_SERVER, IdentityZoneHolder.get().getId());
        String loginToken = testClient.getClientCredentialsOAuthAccessToken("login", "loginsecret", "");
-        String basicAuthForLoginClient = new String(Base64.encode("%s:%s".formatted("login", "loginsecret").getBytes()));
+        String basicAuthForLoginClient = new String(Base64.getEncoder().encode("%s:%s".formatted("login", "loginsecret").getBytes()));


new String(Base64.getEncoder().encode(...)) is charset-dependent and can produce an invalid Base64 string on non-ASCII default charsets. Prefer Base64.getEncoder().encodeToString(...) and specify the input bytes charset (e.g., getBytes(StandardCharsets.UTF_8)) for Basic auth credentials. This pattern appears multiple times in this file.

Suggested change

String basicAuthForLoginClient = new String(Base64.getEncoder().encode("%s:%s".formatted("login", "loginsecret").getBytes()));

String basicAuthForLoginClient = Base64.getEncoder().encodeToString("%s:%s".formatted("login", "loginsecret").getBytes(StandardCharsets.UTF_8));

Replace Spring Security Base64 with java.util.Base64

00dbdae

Spring Security 7 removed the Base64 class from the spring-security-crypto.codec package. Replaced with java.util.Base64 in all files that used org.springframework.security.crypto.codec.Base64. Related to Spring Boot 4 migration.

gdgenchev force-pushed the migrate-base64-utf8 branch from 7739960 to 00dbdae Compare April 22, 2026 09:01

strehle requested a review from Copilot April 22, 2026 09:06

Copilot started reviewing on behalf of strehle April 22, 2026 09:07 View session

Copilot AI reviewed Apr 22, 2026

View reviewed changes

cf-foundation-community-automation Bot added this to Foundational Infrastructure Working Group Apr 22, 2026

cf-foundation-community-automation Bot moved this to Inbox in Foundational Infrastructure Working Group Apr 22, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Replace Spring Security Base64 with java.util equivalent#3857

Replace Spring Security Base64 with java.util equivalent#3857
gdgenchev wants to merge 1 commit intocloudfoundry:developfrom
gdgenchev:migrate-base64-utf8

gdgenchev commented Apr 22, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 22, 2026

Uh oh!

Copilot AI Apr 22, 2026

Uh oh!

Copilot AI Apr 22, 2026

Uh oh!

Copilot AI Apr 22, 2026

Uh oh!

Copilot AI Apr 22, 2026

Uh oh!

Copilot AI Apr 22, 2026

Uh oh!

Copilot AI Apr 22, 2026

Uh oh!

Copilot AI Apr 22, 2026

Uh oh!

Copilot AI Apr 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	String basicAuthForLoginClient = new String(Base64.getEncoder().encode("%s:%s".formatted("login", "loginsecret").getBytes()));
	String basicAuthForLoginClient = Base64.getEncoder().encodeToString("%s:%s".formatted("login", "loginsecret").getBytes(StandardCharsets.UTF_8));

	headers.set("Authorization", "Basic " + new String(Base64.getEncoder().encode("no-such-client:".getBytes(StandardCharsets.UTF_8))));
	headers.set("Authorization", "Basic " + Base64.getEncoder().encodeToString("no-such-client:".getBytes(StandardCharsets.UTF_8)));

	return "Basic %s".formatted(new String(Base64.getEncoder().encode(credentials.getBytes())));
	return "Basic %s".formatted(Base64.getEncoder().encodeToString(credentials.getBytes(StandardCharsets.UTF_8)));

Conversation

gdgenchev commented Apr 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants