///

## Password hashing { #password-hashing }

"Hashing" means converting some content (a password in this case) into a sequence of bytes (just a string) that looks like gibberish.

Whenever you pass exactly the same content (exactly the same password) you get exactly the same gibberish.

But you cannot convert from the gibberish back to the password.

### Why use password hashing { #why-use-password-hashing }

# OAuth2 mit Password (und Hashing), Bearer mit JWT-Tokens

Da wir nun über den gesamten Sicherheitsablauf verfügen, machen wir die Anwendung tatsächlich sicher, indem wir <abbr title="JSON Web Tokens">JWT</abbr>-Tokens und sicheres Passwort-Hashing verwenden.

Diesen Code können Sie tatsächlich in Ihrer Anwendung verwenden, die Passwort-Hashes in Ihrer Datenbank speichern, usw.

Wir bauen auf dem vorherigen Kapitel auf.

## Über JWT

# OAuth2 con Password (y hashing), Bearer con tokens JWT

Ahora que tenemos todo el flujo de seguridad, hagamos que la aplicación sea realmente segura, usando tokens <abbr title="JSON Web Tokens">JWT</abbr> y hashing de contraseñas seguras.

Este código es algo que puedes usar realmente en tu aplicación, guardar los hashes de las contraseñas en tu base de datos, etc.

Vamos a empezar desde donde lo dejamos en el capítulo anterior e incrementarlo.

## Acerca de JWT

/**
 * Hidden superclass of {@link Futures} that provides us a place to declare special GWT versions of
 * the {@link Futures#catching(ListenableFuture, Class, com.google.common.base.Function,
 * java.util.concurrent.Executor) Futures.catching} family of methods. Those versions have slightly
 * different signatures.
 */
@GwtCompatible
@J2ktIncompatible // Super-sourced

Sie sollten niemals Klartext-Passwörter speichern, daher verwenden wir ein (gefaktes) Passwort-Hashing-System.

Wenn die Passwörter nicht übereinstimmen, geben wir denselben Fehler zurück.

#### Passwort-Hashing

„Hashing“ bedeutet: Konvertieren eines Inhalts (in diesem Fall eines Passworts) in eine Folge von Bytes (ein schlichter String), die wie Kauderwelsch aussieht.

        }
        if (!bits.get(combinedHash % bitSize)) {
          return false;
        }
      }
      return true;
    }
  },
  /**
   * This strategy uses all 128 bits of {@link Hashing#murmur3_128} when hashing. It looks different
   * from the implementation in MURMUR128_MITZ_32 because we're avoiding the multiplication in the
   * loop and doing a (much simpler) += hash2. We're also changing the index to a positive number by

  }

  public void testHash_hashesCorrectly() throws Exception {
    byte[] buf = new byte[] {'y', 'a', 'm', 's'};
    HashCode expectedHash = Hashing.md5().hashBytes(buf);
    HashingOutputStream out = new HashingOutputStream(Hashing.md5(), buffer);

    out.write(buf);

    assertEquals(expectedHash, out.hash());
  }

  public void testChecksForNull() throws Exception {

     * including name wildcards, handler name wildcards, and description matching.
     * Results are ordered by sort order and name in ascending order.</p>
     *
     * <p>Description matching supports:</p>
     * <ul>
     *   <li>Wildcard matching (if starts or ends with *)</li>
     *   <li>Prefix matching (if ends with *)</li>
     *   <li>Exact phrase matching (otherwise)</li>
     * </ul>
     *

     * Applies fuzzy matching configuration including edit distance, expansions, and prefix length.
     *
     * @param context the query context containing field mappings
     * @param fuzzyQuery the Lucene FuzzyQuery to convert
     * @param boost the boost factor to apply
     * @return OpenSearch QueryBuilder configured for fuzzy matching
     */

   *     sequence is empty
   */
  public boolean matchesNoneOf(CharSequence sequence) {
    return indexIn(sequence) == -1;
  }

  /**
   * Returns the index of the first matching BMP character in a character sequence, or {@code -1} if
   * no matching character is present.
   *
   * <p>The default implementation iterates over the sequence in forward order calling {@link
   * #matches} for each character.
   *