Fix Broken User Authentication in Dropwizard

public class InsecureAuthenticator implements Authenticator {
    @Override
    public Optional authenticate(BasicCredentials credentials) throws AuthenticationException {
        User user = userDAO.findByName(credentials.getUsername());
        // CRITICAL VULNERABILITY: Plain-text password comparison
        // No hashing, no salt, susceptible to timing attacks and DB leaks
        if (user != null && user.getPassword().equals(credentials.getPassword())) {
            return Optional.of(user);
        }
        return Optional.empty();
    }
}

public class SecureAuthenticator implements Authenticator {
    @Override
    public Optional authenticate(BasicCredentials credentials) throws AuthenticationException {
        return userDAO.findByName(credentials.getUsername())
            // Use BCrypt or Argon2 for password verification
            .filter(user -> BCrypt.checkpw(credentials.getPassword(), user.getPasswordHash()))
            .map(user -> new User(user.getName(), user.getRoles()));
    }
}
// In Application.run():
environment.jersey().register(new AuthDynamicFeature(new BasicCredentialAuthFilter.Builder()
.setAuthenticator(new SecureAuthenticator())
.setAuthorizer(new UserAuthorizer())
.setRealm(“SECURE_ZONE”)
.buildAuthFilter()));
environment.jersey().register(new AuthValueFactoryProvider.Binder<>(User.class));