Modern web uygulamalar\u0131n\u0131n omurgas\u0131n\u0131 olu\u015fturan Spring Boot, h\u0131zl\u0131 geli\u015ftirme yetenekleriyle \u00f6ne \u00e7\u0131karken, g\u00fcvenlik konusu asla g\u00f6z ard\u0131 edilmemelidir. \u00d6zellikle kullan\u0131c\u0131 \u015fifrelerinin y\u00f6netimi, bir uygulaman\u0131n g\u00fcvenilirli\u011fini ve kullan\u0131c\u0131lar\u0131n gizlili\u011fini do\u011frudan etkileyen kritik bir aland\u0131r. Yanl\u0131\u015f veya eksik \u015fifre y\u00f6netimi uygulamalar\u0131, veri ihlallerine, kimlik h\u0131rs\u0131zl\u0131\u011f\u0131na ve uygulaman\u0131n itibar\u0131n\u0131n zedelenmesine yol a\u00e7abilir. Bu makalede, Spring Boot tabanl\u0131 uygulamalarda \u015fifre y\u00f6netiminin temel prensiplerini, en iyi uygulamalar\u0131n\u0131 ve Spring Security \u00e7at\u0131s\u0131 alt\u0131nda nas\u0131l etkili bir \u015fekilde uygulanabilece\u011fini detayl\u0131 bir \u015fekilde inceleyece\u011fiz. Amac\u0131m\u0131z, geli\u015ftiricilere g\u00fcvenli ve s\u00fcrd\u00fcr\u00fclebilir \u015fifre y\u00f6netimi stratejileri olu\u015fturmalar\u0131 i\u00e7in kapsaml\u0131 bir rehber sunmakt\u0131r.<\/p>\n
\u015eifreler, dijital kimliklerimizin anahtar\u0131d\u0131r ve bu nedenle en y\u00fcksek d\u00fczeyde korunmalar\u0131 gerekir. Uygulamalar, kullan\u0131c\u0131 \u015fifrelerini do\u011fru bir \u015fekilde saklamak ve do\u011frulamakla y\u00fck\u00fcml\u00fcd\u00fcr. Bu b\u00f6l\u00fcm, \u015fifre g\u00fcvenli\u011finin temel prensiplerini ve yayg\u0131n g\u00fcvenlik zafiyetlerini ele almaktad\u0131r.<\/p>\n
Spring Boot, Spring Security \u00e7at\u0131s\u0131 ile entegre olarak \u015fifre y\u00f6netimini kolayla\u015ft\u0131ran g\u00fc\u00e7l\u00fc ara\u00e7lar sunar. Bu ara\u00e7lar, geli\u015ftiricilerin yukar\u0131da belirtilen prensiplere uygun, g\u00fcvenli uygulamalar geli\u015ftirmesine yard\u0131mc\u0131 olur. Spring Security, kimlik do\u011frulama ve yetkilendirme s\u00fcre\u00e7lerinin yan\u0131 s\u0131ra \u015fifrelerin g\u00fcvenli bir \u015fekilde saklanmas\u0131 ve do\u011frulanmas\u0131 i\u00e7in de standart mekanizmalar sa\u011flar.<\/p>\n
Spring Security, \u015fifre y\u00f6netiminin en kritik bile\u015feni olan \u015fifreleme ve do\u011frulama i\u015flemlerini y\u00f6netmek i\u00e7in Uygulaman\u0131zda bir <\/code><\/p>\n Yukar\u0131daki \u00f6rnekte, Yeni bir kullan\u0131c\u0131 kaydedilirken, \u015fifresinin g\u00fcvenli bir \u015fekilde i\u015flenmesi ve veritaban\u0131na kaydedilmesi hayati \u00f6nem ta\u015f\u0131r. Bu b\u00f6l\u00fcm, Spring Security'nin bu s\u00fcreci nas\u0131l y\u00f6netti\u011fini ve bir \u00f6rnekle a\u00e7\u0131klayacakt\u0131r.<\/p>\n Spring Security, kullan\u0131c\u0131 kimlik do\u011frulama s\u00fcrecinde kullan\u0131c\u0131 bilgilerini almak i\u00e7in <\/code><\/p>\n Yeni bir kullan\u0131c\u0131 kaydedilirken, kullan\u0131c\u0131n\u0131n girdi\u011fi ham \u015fifre do\u011frudan veritaban\u0131na kaydedilmemeli, bunun yerine <\/code><\/p>\n \u015eifreler veritaban\u0131nda genellikle Kullan\u0131c\u0131lar\u0131n \u015fifrelerini unutmas\u0131 veya g\u00fcncellemek istemesi durumunda, g\u00fcvenli ve kullan\u0131c\u0131 dostu bir ak\u0131\u015f sunmak \u00f6nemlidir. Bu s\u00fcre\u00e7ler, potansiyel g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 bar\u0131nd\u0131rabilir ve dikkatle tasarlanmal\u0131d\u0131r.<\/p>\n \u015eifre s\u0131f\u0131rlama i\u015flemi genellikle a\u015fa\u011f\u0131daki ad\u0131mlar\u0131 i\u00e7erir:<\/p>\n \u00d6nemli Notlar:<\/strong><\/p>\n Kullan\u0131c\u0131lar\u0131n mevcut \u015fifrelerini bilerek yeni bir \u015fifre belirlemeleri durumunda, genellikle mevcut \u015fifrenin do\u011frulanmas\u0131 istenir. Bu, yetkisiz ki\u015filerin hesaba eri\u015fip \u015fifreyi de\u011fi\u015ftirmesini engeller.<\/p>\n <\/code><\/p>\n G\u00fc\u00e7l\u00fc \u015fifre politikalar\u0131 uygulamak, kullan\u0131c\u0131lar\u0131n tahmin edilmesi zor \u015fifreler se\u00e7mesini te\u015fvik eder. \u00d6rnek politikalar:<\/p>\n Bu politikalar, kullan\u0131c\u0131 aray\u00fcz\u00fcnde (client-side) ve sunucu taraf\u0131nda (server-side) do\u011frulanmal\u0131d\u0131r.<\/p>\n Temel \u015fifre y\u00f6netimi prensiplerinin \u00f6tesinde, kullan\u0131c\u0131 hesaplar\u0131n\u0131n g\u00fcvenli\u011fini art\u0131rmak i\u00e7in \u00e7e\u015fitli geli\u015fmi\u015f uygulamalar mevcuttur. Bu uygulamalar, genel g\u00fcvenlik duru\u015funu g\u00fc\u00e7lendirir.<\/p>\n \u0130ki fakt\u00f6rl\u00fc kimlik do\u011frulama (2FA), kullan\u0131c\u0131lar\u0131n bir \u015fifrenin yan\u0131 s\u0131ra ek bir do\u011frulama fakt\u00f6r\u00fc (\u00f6rne\u011fin, cep telefonuna g\u00f6nderilen kod, biyometrik veri) sa\u011flamas\u0131n\u0131 gerektirir. Bu, \u015fifre \u00e7al\u0131nsa bile yetkisiz eri\u015fimi b\u00fcy\u00fck \u00f6l\u00e7\u00fcde zorla\u015ft\u0131r\u0131r. Spring Security, 2FA entegrasyonu i\u00e7in do\u011frudan bir mod\u00fcl sunmasa da, geli\u015ftiricilerin TOTP (Time-based One-Time Password) algoritmalar\u0131n\u0131 veya SMS\/e-posta tabanl\u0131 kod g\u00f6nderme servislerini kullanarak kolayca entegre etmelerine olanak tan\u0131r.<\/p>\n Entegrasyon Ad\u0131mlar\u0131:<\/strong><\/p>\n Kullan\u0131c\u0131lar\u0131n farkl\u0131 uygulamalar i\u00e7in g\u00fc\u00e7l\u00fc ve benzersiz \u015fifreler kullanmalar\u0131n\u0131 te\u015fvik etmenin bir yolu, \u015fifre y\u00f6neticilerini desteklemektir. Taray\u0131c\u0131 tabanl\u0131 veya harici \u015fifre y\u00f6neticileri, kullan\u0131c\u0131lar\u0131n karma\u015f\u0131k \u015fifreleri hat\u0131rlama y\u00fck\u00fcn\u00fc hafifletir. Tek Oturum A\u00e7ma (SSO) \u00e7\u00f6z\u00fcmleri (OAuth2, OpenID Connect gibi), kullan\u0131c\u0131lar\u0131n tek bir kimlik bilgisi setiyle birden fazla uygulamaya eri\u015fmesine olanak tan\u0131r. Bu, \u015fifre yorgunlu\u011funu azalt\u0131r ve merkezi bir kimlik do\u011frulama noktas\u0131 sa\u011flayarak g\u00fcvenli\u011fi art\u0131rabilir. Spring Security, OAuth2\/OpenID Connect gibi SSO protokollerini desteklemek i\u00e7in kapsaml\u0131 mod\u00fcller sunar.<\/p>\n \u015eifre y\u00f6netimi s\u00fcre\u00e7lerinin g\u00fcvenli\u011fini sa\u011flamak i\u00e7in d\u00fczenli g\u00fcvenlik denetimleri ve kapsaml\u0131 loglama kritik \u00f6neme sahiptir. Ba\u015far\u0131s\u0131z giri\u015f denemeleri, \u015fifre s\u0131f\u0131rlama talepleri, \u015fifre de\u011fi\u015fiklikleri gibi t\u00fcm \u015fifre ile ilgili olaylar detayl\u0131 bir \u015fekilde loglanmal\u0131d\u0131r. Bu loglar, potansiyel sald\u0131r\u0131lar\u0131 tespit etmek, g\u00fcvenlik ihlallerini analiz etmek ve uyumluluk gereksinimlerini kar\u015f\u0131lamak i\u00e7in kullan\u0131labilir.<\/p>\n Loglanmas\u0131 Gerekenler:<\/strong><\/p>\n Loglar\u0131n g\u00fcvenli bir \u015fekilde sakland\u0131\u011f\u0131ndan, yetkisiz eri\u015fime kar\u015f\u0131 korundu\u011fundan ve d\u00fczenli olarak incelendi\u011finden emin olunmal\u0131d\u0131r.<\/p>\n Spring Boot uygulamalar\u0131nda g\u00fcvenli \u015fifre y\u00f6netimi, sadece teknik bir gereklilik de\u011fil, ayn\u0131 zamanda kullan\u0131c\u0131 g\u00fcvenini ve uygulaman\u0131n itibar\u0131n\u0131 koruman\u0131n temel ta\u015f\u0131d\u0131r. Bu makalede ele ald\u0131\u011f\u0131m\u0131z prensiplere uyarak ve Spring Security'nin sundu\u011fu g\u00fc\u00e7l\u00fc ara\u00e7lar\u0131 etkin bir \u015fekilde kullanarak, geli\u015ftiriciler g\u00fc\u00e7l\u00fc, dayan\u0131kl\u0131 ve g\u00fcvenli \u015fifre y\u00f6netimi mekanizmalar\u0131 olu\u015fturabilirler. \u015eifreleri asla d\u00fcz metin olarak saklamamak, g\u00fc\u00e7l\u00fc hash algoritmalar\u0131 kullanmak, salt eklemek, \u015fifre politikalar\u0131 uygulamak ve iki fakt\u00f6rl\u00fc kimlik do\u011frulama gibi geli\u015fmi\u015f g\u00fcvenlik \u00f6nlemlerini entegre etmek, uygulamalar\u0131n\u0131z\u0131 siber tehditlere kar\u015f\u0131 daha diren\u00e7li hale getirecektir. Unutmay\u0131n, g\u00fcvenlik s\u00fcrekli bir s\u00fcre\u00e7tir ve en iyi uygulamalar\u0131n d\u00fczenli olarak g\u00f6zden ge\u00e7irilmesi ve g\u00fcncellenmesi gerekmektedir.<\/p>\n BCrypt, adaptif bir hash algoritmas\u0131d\u0131r, yani i\u015flem maliyeti (iterasyon say\u0131s\u0131) ayarlanabilir. Bu, donan\u0131m g\u00fcc\u00fc artt\u0131k\u00e7a brute-force sald\u0131r\u0131lar\u0131na kar\u015f\u0131 direnci art\u0131rmak i\u00e7in kolayca g\u00fcncellenebilece\u011fi anlam\u0131na gelir. Ayr\u0131ca, her \u015fifre i\u00e7in otomatik olarak benzersiz bir salt \u00fcretir ve y\u00f6netir, bu da rainbow table sald\u0131r\u0131lar\u0131n\u0131 etkisiz hale getirir. MD5 veya SHA-256 gibi daha h\u0131zl\u0131 algoritmalar, modern i\u015flemcilerle \u00e7ok h\u0131zl\u0131 bir \u015fekilde k\u0131r\u0131labilirken, BCrypt gibi algoritmalar bu t\u00fcr sald\u0131r\u0131lar\u0131 yava\u015flat\u0131r.<\/p>\n \u015eifre s\u0131f\u0131rlama tokenlar\u0131 a\u015fa\u011f\u0131daki \u015fekillerde g\u00fcvenli tutulmal\u0131d\u0131r:<\/p>\n Kesinlikle hay\u0131r. \u015eifreleri d\u00fcz metin olarak saklamak, bir veri ihlali durumunda t\u00fcm kullan\u0131c\u0131 \u015fifrelerinin sald\u0131rganlar\u0131n eline ge\u00e7mesine neden olur. Bu, uygulaman\u0131z\u0131n g\u00fcvenli\u011fini tamamen tehlikeye atar ve kullan\u0131c\u0131lar\u0131n\u0131z\u0131n di\u011fer platformlardaki hesaplar\u0131n\u0131 da riske atar (bir\u00e7ok kullan\u0131c\u0131 ayn\u0131 \u015fifreyi farkl\u0131 yerlerde kullanma e\u011filimindedir). Her zaman g\u00fc\u00e7l\u00fc, tek y\u00f6nl\u00fc hash algoritmalar\u0131 (BCrypt gibi) kullanarak \u015fifreleri hashlemelisiniz.<\/p>\n Evet, teorik olarak Spring Security olmadan da \u015fifre y\u00f6netimi yap\u0131labilir. Ancak, Spring Security, bu t\u00fcr g\u00fcvenlik g\u00f6revlerini standart, test edilmi\u015f ve g\u00fcvenli bir \u015fekilde ger\u00e7ekle\u015ftirmek i\u00e7in tasarlanm\u0131\u015f kapsaml\u0131 bir \u00e7er\u00e7eve sunar. Kendi \u015fifre y\u00f6netimi mekanizman\u0131z\u0131 s\u0131f\u0131rdan yazmak, g\u00fcvenlik a\u00e7\u0131klar\u0131na yol a\u00e7abilecek karma\u015f\u0131k bir s\u00fcre\u00e7tir ve genellikle \u00f6nerilmez. Spring Security, PasswordEncoder<\/code> aray\u00fcz\u00fcn\u00fc sunar. Bu b\u00f6l\u00fcm, PasswordEncoder<\/code>‘\u0131n nas\u0131l kullan\u0131laca\u011f\u0131n\u0131 ve en pop\u00fcler uygulamas\u0131 olan BCryptPasswordEncoder<\/code>‘\u0131 ele almaktad\u0131r.<\/p>\nPasswordEncoder<\/code> Aray\u00fcz\u00fc<\/h4>\nPasswordEncoder<\/code>, Spring Security’nin \u015fifreleri hashlemek ve do\u011frulamak i\u00e7in kulland\u0131\u011f\u0131 temel aray\u00fczd\u00fcr. Bu aray\u00fcz, \u015fifreleme algoritmas\u0131ndan ba\u011f\u0131ms\u0131z olarak \u015fifre i\u015flemlerini soyutlar. Temel metotlar\u0131 \u015funlard\u0131r:<\/p>\n\n
encode(CharSequence rawPassword)<\/code>: Ham \u015fifreyi hashler.<\/li>\nmatches(CharSequence rawPassword, String encodedPassword)<\/code>: Ham \u015fifrenin, verilen hashlenmi\u015f \u015fifreyle e\u015fle\u015fip e\u015fle\u015fmedi\u011fini kontrol eder.<\/li>\n<\/ul>\nPasswordEncoder<\/code> bean’i tan\u0131mlaman\u0131z, Spring Security’nin otomatik olarak bu bean’i kullanarak \u015fifre i\u015flemlerini yapmas\u0131n\u0131 sa\u011flar.<\/p>\nBCryptPasswordEncoder<\/code> Kullan\u0131m\u0131<\/h4>\nBCryptPasswordEncoder<\/code>, Spring Security’nin \u00f6nerdi\u011fi ve en yayg\u0131n kullan\u0131lan PasswordEncoder<\/code> implementasyonlar\u0131ndan biridir. BCrypt, hem g\u00fc\u00e7l\u00fc bir hash algoritmas\u0131d\u0131r hem de adaptif bir yap\u0131ya sahiptir; yani i\u015flem maliyeti (iterasyon say\u0131s\u0131) ayarlanabilir. Bu, brute-force sald\u0131r\u0131lar\u0131na kar\u015f\u0131 direnci art\u0131r\u0131r.<\/p>\n\nimport org.springframework.context.annotation.Bean;\nimport org.springframework.context.annotation.Configuration;\nimport org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;\nimport org.springframework.security.crypto.password.PasswordEncoder;\n\n@Configuration\npublic class SecurityConfig {\n\n @Bean\n public PasswordEncoder passwordEncoder() {\n \/\/ G\u00fcvenlik seviyesini belirten 'strength' parametresi (4-31 aras\u0131)\n \/\/ Varsay\u0131lan de\u011feri 10'dur. Daha y\u00fcksek de\u011fer daha g\u00fcvenli ama daha yava\u015f demektir.\n return new BCryptPasswordEncoder(12); \n }\n}\n<\/pre>\nBCryptPasswordEncoder<\/code>'\u0131 12 g\u00fcc\u00fcnde (strength) bir parametre ile yap\u0131land\u0131r\u0131yoruz. Bu de\u011fer, \u015fifreleme i\u015fleminin ka\u00e7 kez tekrarlanaca\u011f\u0131n\u0131 belirler ve daha y\u00fcksek bir de\u011fer, \u015fifre k\u0131rma giri\u015fimlerini daha yava\u015f hale getirir.<\/p>\n\u015eifreleme Algoritmas\u0131 Se\u00e7imi ve G\u00fc\u00e7lendirme (Salt)<\/h4>\n
BCryptPasswordEncoder<\/code>, salt \u00fcretme ve y\u00f6netme i\u015flemini otomatik olarak yapar, bu da geli\u015ftiricinin i\u015fini b\u00fcy\u00fck \u00f6l\u00e7\u00fcde kolayla\u015ft\u0131r\u0131r. Her \u015fifre hash'i, kendi benzersiz salt'\u0131n\u0131 i\u00e7erir. Bu sayede, ayn\u0131 ham \u015fifre iki farkl\u0131 kullan\u0131c\u0131 i\u00e7in farkl\u0131 hash de\u011ferleri \u00fcretecektir. Algoritma se\u00e7imi konusunda, SHA-256 veya MD5 gibi eski ve daha h\u0131zl\u0131 algoritmalar yerine, BCrypt, PBKDF2 veya Argon2 gibi modern, yava\u015f ve salt destekli algoritmalar tercih edilmelidir. Bu algoritmalar, i\u015flemci yo\u011fun olduklar\u0131 i\u00e7in brute-force sald\u0131r\u0131lar\u0131na kar\u015f\u0131 daha diren\u00e7lidir.<\/p>\nKullan\u0131c\u0131 Kayd\u0131 ve \u015eifre Saklama Mekanizmalar\u0131<\/h3>\n
UserDetailsService<\/code> ve UserDetails<\/code><\/h4>\nUserDetailsService<\/code> aray\u00fcz\u00fcn\u00fc kullan\u0131r. Bu aray\u00fcz\u00fcn loadUserByUsername(String username)<\/code> metodu, verilen kullan\u0131c\u0131 ad\u0131na kar\u015f\u0131l\u0131k gelen UserDetails<\/code> nesnesini d\u00f6nd\u00fcr\u00fcr. UserDetails<\/code>, kullan\u0131c\u0131n\u0131n kullan\u0131c\u0131 ad\u0131n\u0131, \u015fifresini, yetkilerini ve hesap durumunu (aktif mi, kilitli mi vb.) i\u00e7eren bir aray\u00fczd\u00fcr.<\/p>\n\nimport org.springframework.security.core.userdetails.User;\nimport org.springframework.security.core.userdetails.UserDetails;\nimport org.springframework.security.core.userdetails.UserDetailsService;\nimport org.springframework.security.core.userdetails.UsernameNotFoundException;\nimport org.springframework.stereotype.Service;\n\nimport java.util.ArrayList;\n\n@Service\npublic class MyUserDetailsService implements UserDetailsService {\n\n \/\/ Ger\u00e7ek bir uygulamada bu bir veritaban\u0131 \u00e7a\u011fr\u0131s\u0131 olacakt\u0131r\n private final UserRepository userRepository; \/\/ Varsayal\u0131m b\u00f6yle bir repository var\n\n public MyUserDetailsService(UserRepository userRepository) {\n this.userRepository = userRepository;\n }\n\n @Override\n public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {\n \/\/ \u00d6rnek bir kullan\u0131c\u0131 y\u00fckleme. Ger\u00e7ekte veritaban\u0131ndan al\u0131n\u0131r.\n \/\/ Kullan\u0131c\u0131y\u0131 veritaban\u0131ndan bul\n \/\/ UserEntity userEntity = userRepository.findByUsername(username)\n \/\/ .orElseThrow(() -> new UsernameNotFoundException(\"Kullan\u0131c\u0131 bulunamad\u0131: \" + username));\n\n \/\/ Ge\u00e7ici bir \u00f6rnek:\n if (\"user\".equals(username)) {\n \/\/ \u015eifre veritaban\u0131ndan hashlenmi\u015f olarak gelmeli\n return new User(\"user\", \"$2a$12$R.9tX8qX.9tX8qX.9tX8qX.9tX8qX.9tX8qX.9tX8qX.9tX8qX\", new ArrayList<>());\n } else {\n throw new UsernameNotFoundException(\"Kullan\u0131c\u0131 bulunamad\u0131: \" + username);\n }\n }\n}\n<\/pre>\nYeni Kullan\u0131c\u0131 Kayd\u0131 \u0130\u015flemi (Kod \u00d6rne\u011fi)<\/h4>\n
PasswordEncoder<\/code> kullan\u0131larak hashlenmelidir.<\/p>\n\nimport org.springframework.security.crypto.password.PasswordEncoder;\nimport org.springframework.stereotype.Service;\n\n@Service\npublic class UserService {\n\n private final UserRepository userRepository; \/\/ Varsayal\u0131m b\u00f6yle bir repository var\n private final PasswordEncoder passwordEncoder;\n\n public UserService(UserRepository userRepository, PasswordEncoder passwordEncoder) {\n this.userRepository = userRepository;\n this.passwordEncoder = passwordEncoder;\n }\n\n public UserEntity registerNewUser(String username, String rawPassword) {\n \/\/ \u015eifreyi hashle\n String encodedPassword = passwordEncoder.encode(rawPassword);\n\n \/\/ Yeni kullan\u0131c\u0131 nesnesi olu\u015ftur\n UserEntity newUser = new UserEntity(); \/\/ Varsayal\u0131m UserEntity s\u0131n\u0131f\u0131m\u0131z var\n newUser.setUsername(username);\n newUser.setPassword(encodedPassword); \/\/ Hashlenmi\u015f \u015fifreyi kaydet\n\n \/\/ Kullan\u0131c\u0131y\u0131 veritaban\u0131na kaydet\n return userRepository.save(newUser);\n }\n}\n<\/pre>\nVeritaban\u0131nda \u015eifre Saklama Stratejileri<\/h4>\n
VARCHAR(255)<\/code> veya VARCHAR(max)<\/code> gibi bir s\u00fctunda saklan\u0131r. BCrypt hashleri genellikle 60 karakter uzunlu\u011funda oldu\u011fundan, bu uzunluk yeterli olacakt\u0131r. \u00d6nemli olan, \u015fifre s\u00fctununun asla d\u00fcz metin \u015fifre i\u00e7ermemesidir. Ayr\u0131ca, veritaban\u0131 seviyesinde g\u00fcvenlik \u00f6nlemleri almak, \u00f6rne\u011fin yetkilendirmeleri k\u0131s\u0131tlamak ve \u015fifreli ba\u011flant\u0131lar kullanmak da \u00f6nemlidir.<\/p>\n\u015eifre S\u0131f\u0131rlama ve G\u00fcncelleme Ak\u0131\u015flar\u0131<\/h3>\n
G\u00fcvenli \u015eifre S\u0131f\u0131rlama Token Mekanizmas\u0131<\/h4>\n
\n
PasswordEncoder<\/code> ile hashlenir ve kullan\u0131c\u0131n\u0131n eski \u015fifresiyle de\u011fi\u015ftirilir. Token ge\u00e7ersiz k\u0131l\u0131n\u0131r.<\/li>\n<\/ol>\n\n
\u015eifre G\u00fcncelleme \u0130\u015flemi<\/h4>\n
\nimport org.springframework.security.crypto.password.PasswordEncoder;\nimport org.springframework.stereotype.Service;\n\n@Service\npublic class AccountService {\n\n private final UserRepository userRepository;\n private final PasswordEncoder passwordEncoder;\n\n public AccountService(UserRepository userRepository, PasswordEncoder passwordEncoder) {\n this.userRepository = userRepository;\n this.passwordEncoder = passwordEncoder;\n }\n\n public boolean changePassword(String username, String oldPassword, String newPassword) {\n UserEntity user = userRepository.findByUsername(username)\n .orElseThrow(() -> new UsernameNotFoundException(\"Kullan\u0131c\u0131 bulunamad\u0131.\"));\n\n \/\/ Mevcut \u015fifreyi do\u011frula\n if (!passwordEncoder.matches(oldPassword, user.getPassword())) {\n return false; \/\/ Eski \u015fifre yanl\u0131\u015f\n }\n\n \/\/ Yeni \u015fifreyi hashle ve kaydet\n user.setPassword(passwordEncoder.encode(newPassword));\n userRepository.save(user);\n return true;\n }\n}\n<\/pre>\n\u015eifre Politikalar\u0131 ve Zorunluluklar\u0131<\/h4>\n
\n
Geli\u015fmi\u015f \u015eifre Y\u00f6netimi Uygulamalar\u0131<\/h3>\n
\u0130ki Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (2FA) Entegrasyonu<\/h4>\n
\n
\u015eifre Y\u00f6neticileri ve SSO (Single Sign-On)<\/h4>\n
G\u00fcvenlik Denetimleri ve Loglama<\/h4>\n
\n
Sonu\u00e7<\/h3>\n
SSS (S\u0131k Sorulan Sorular)<\/h3>\n
BCrypt neden di\u011fer hash algoritmalar\u0131na g\u00f6re daha \u00e7ok tercih edilmeli?<\/h4>\n
\u015eifre s\u0131f\u0131rlama tokenlar\u0131 nas\u0131l g\u00fcvenli tutulur?<\/h4>\n
\n
\u015eifreler veritaban\u0131nda d\u00fcz metin olarak saklanabilir mi?<\/h4>\n
Spring Security olmadan \u015fifre y\u00f6netimi yap\u0131labilir mi?<\/h4>\n
PasswordEncoder<\/code> aray\u00fcz\u00fc gibi bile\u015fenlerle bu s\u00fcreci basitle\u015ftirir ve en iyi uygulamalar\u0131 takip etmenizi sa\u011flar.<\/p>\n","protected":false},"excerpt":{"rendered":"Modern web uygulamalar\u0131n\u0131n omurgas\u0131n\u0131 olu\u015fturan Spring Boot, h\u0131zl\u0131 geli\u015ftirme yetenekleriyle \u00f6ne \u00e7\u0131karken, g\u00fcvenlik konusu asla g\u00f6z ard\u0131 edilme…","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-38528","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-genel","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\n