title: How Spring encodePassword with salt
body: <p>I introduce Spring security for a web application. First I have my authentication manager as follows.</p>
  
  <pre><code>&lt;authentication-manager&gt;
      &lt;authentication-provider&gt;
          &lt;password-encoder hash='md5'&gt;
          &lt;/password-encoder&gt; 
          &lt;jdbc-user-service data-source-ref="dataSource"/&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  </code></pre>
  
  <p>For tesing I'm going to use '1' as both username and password. I use a online md5 hash generator and I got 'c4ca4238a0b923820dcc509a6f75849b' for md5(1). Login works fine with this configuration. The I wanted to try salt and I modify authentication manager as follows.</p>
  
  <pre><code>&lt;authentication-manager&gt;
      &lt;authentication-provider&gt;
          &lt;password-encoder hash='md5'&gt;
              &lt;salt-source user-property="username"/&gt;
          &lt;/password-encoder&gt; 
          &lt;jdbc-user-service data-source-ref="dataSource"/&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  </code></pre>
  
  <p>So as I read in web how salt used is like hash(salt + password). So using the same tool I hash '11' then got hash value '6512bd43d9caa6e02c990b0a82652dca'. I update the database with that value. But now login fail with error thrown 'Caused : Bad credentials'. Which means password didn't match with the database. So my question is does that mean Spring use a different way for salting?</p>