I have a registration endpoint as below where i accept user information including username and password from the user. I use bcrypt to encode this password and store it in DB.

While login i take username and password from user as input. I encode the provided password and compare the hash to the once stored in DB. Somehow bcrypt is giving out two different hashes for same password causing the login to fail.

Below are my controller , service and utility classes :

Controller :

```
@RestController
@RequestMapping(value = "/user")
public class UserController {

    private static final Logger logger = LogManager.getLogger(UserController.class);

    @Autowired
    RegistrationService registrationService;

    @Autowired
    LoginService loginService;

    /**
     * Method to allow user to register for application
     * @param request
     * @return
     */
    @RequestMapping(value = "/register", method = RequestMethod.POST, produces = "application/json" )
    public boolean registerUser(@Valid @RequestBody RegistrationRequestDTO request) {
        logger.debug("Register endpoint initiaited to create a new user!!");
        registrationService.saveUserDetails(request);
        logger. info("New user with login id : " + request.getUserName() + " has been created!!");  
        return true;
    }

    /**
     * Method to authenticate user
     * @param request
     * @return
     * @throws Exception
     */
    @RequestMapping(value = "/login", method = RequestMethod.POST, produces = "application/json")
    public boolean login(@Valid @RequestBody LoginRequestDTO request) throws Exception {
        logger.debug("Login endpoint has been called!!!");
        if(request == null) {
            logger.error("No credentials received in the request!!");
            throw new Exception("No user credentials recieved");

        }

        boolean isUserAuthenticated = loginService.validateUser(request);
        return isUserAuthenticated;

    }
}

```

Service :

```
@Service
public class LoginService {

    private static final Logger logger = LogManager.getLogger(LoginService.class);

    @Autowired
    UserUtility userUtility;

    @Autowired
    UsersDAO usersDAO;

    public boolean validateUser(LoginRequestDTO request) throws Exception {

        String userName = request.getUserName();
        String password = request.getPassword();
        logger.info("User  : " + userName + " is logging in");
            List<Users> users = usersDAO.fetchUserForUserName(userName);
            if(users.size() > 1) {
                logger.error("Duplicate records found for user name : " + userName);
                throw new LoginException("Duplicate record found!!");
            }else if(users.size() == 0) {
                logger.error("No records found for user name : " + userName);
                throw new LoginException("User name is invalid!!");
            }

            Users user = users.get(0);
            boolean isUserAuthenticated = userUtility.matchPassword(password, user);
        return isUserAuthenticated;
    }
}

@Service
public class RegistrationService {

    @Autowired
    ModelMapper modelMapper;

    @Autowired
    UserUtility userUtility;

    @Autowired
    UsersDAO usersDAO;

    Logger logger = LogManager.getLogger(RegistrationService.class);

    public boolean saveUserDetails(RegistrationRequestDTO registrationRequestDTO) {

        logger.debug("User details recieved from customer -- " + registrationRequestDTO.toString());

        Users user = modelMapper.map(registrationRequestDTO, Users.class);
        user.setPassword(userUtility.createPasswordHash(user.getPassword()));
        usersDAO.saveUser(user);

        return true;
    }
}

```

Utility Class :

```
@Component
public class UserUtility {

    Logger logger = LogManager.getLogger(UserUtility.class);

    @Autowired
    PasswordEncoder encoder;

    public String createPasswordHash(String password) {

        if(StringUtils.isEmpty(password)) {
            logger.error("Password recieved is either empty or null!!");
            return null;

        }

        return encoder.encode(password);
    }

    public boolean matchPassword(String password, Users user) throws Exception{

        if(StringUtils.isEmpty(password)) {
            logger.error("Password not entered by user");
            throw new Exception("Password dnot entered by user!!");
        }

        String hashedPasswordProvided = createPasswordHash(password);
        logger.info("Hashed Password Provided : " + hashedPasswordProvided);
        logger.info("Hashed Password Stored : " + user.getPassword());
        String hashedPasswordStored = user.getPassword();
        if(hashedPasswordProvided.equals(hashedPasswordStored))
            return true;
        else
            return false;

    }
}

```

I am not able to figure out why the same library is providing two different hashed for same string. I am not using salt here while encrypting the password on registration as well as login.