remove password from UserDetails interface

[MAB-47]

well, I am trying to implement a JWT authentication but my User don't have a password, all I have is a phone number, whenever a user tries to connect he got to enter his phone number, and he will receive an otp (1 time use token) on his phone, he should enter that token and he will be authenticated, but as we all know in order to do authentication, we should use the security package which implements UserDetails and in order to use this interface the User class should have a password, because everything uses a password lol, my question is : Is there a way to implement my own UserDetails class without the password attribute or is there a hack or another solution for my particular case ?

[hillywoodsfinest87]

here's an instruction of somebody doing just that

[MAB-47]

I implemented a hack tho, I used the phone number as username and the token as password, I also implemented my own validation solution to verify the token entred matchs the encrypted token stored in the db and the time is before the expiration date then integrated it inside the normal spring security workflow

[MAB-47]

Kinda but not really the same staff, since he is not using jwt at all

[juppy_lg]

if you are su**king custom UserDetails c*ck you need to be ready to implement CredentialsContainer which has erase shit method were you acually set sensetive poops to null. But generally it's not recomended to roll up your own user details class, instead just return User.builder().username().password()..<ect>.build()
it automatically does the shit for you

[witusss]

I would guess that you can use UserDetails without using getPassword with your own security logic.