private boolean matchesPreviousPasswords ( String password , String username , int historySize ) { // No need to compare if no history is relevant if ( historySize <= 0 ) return false ; // Check password against all recorded hashes List < PasswordRecordModel > history = passwordRecordMapper . select ( username , historySize ) ; for ( PasswordRecordModel record : history ) { byte [ ] hash = encryptionService . createPasswordHash ( password , record . getPasswordSalt ( ) ) ; if ( Arrays . equals ( hash , record . getPasswordHash ( ) ) ) return true ; } // No passwords match return false ; }
Returns whether the given password matches any of the user s previous passwords . Regardless of the value specified here the maximum number of passwords involved in this check depends on how many previous passwords were actually recorded which depends on the password policy .