I'm not sure what the default behavior for invalid inputs should be.

org.springframework.security.crypto.password.DelegatingPasswordEncoder#upgradeEncoding returns true for all invalid inputs (null, no parseable id, unknown id) while org.springframework.security.crypto.password.PasswordEncoder#upgradeEncoding always returns false.

The default of false makes sense, because it prevents useless re-encodings on every login.

How should org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder#upgradeEncoding behave for invalid inputs (null or non-bcrypt)? true, false or IllegalArgumentException ?

Good question @larsgrefer

DelegatingPasswordEncoder returns true for null, no id, unknown id because we expect its configuration to change over time. All we care about is that the value is encoded with the configured PasswordEncoder. Note that these are actually valid as there is the potential to fallback if there is an unknown id, null id, etc.

BCryptPasswordEncoder should return false for a null input because it will blow up if it is encoded. For non-bcrypt it should fail with an Exception.

Thanks for the updates @larsgrefer. It appears that the tests fail.

org.springframework.security.crypto.bcrypt.BCryptPasswordEncoderTests > upgradeFromNullOrEmpty FAILED
    org.junit.ComparisonFailure at BCryptPasswordEncoderTests.java:191

@rwinch The tests are fixed now

Thanks for all your work on this PR @larsgrefer! This is now merged into master via d3d6a87 I added a little polish to the tests via 742df2c